Missing authentication in GE Grid Solutions Reason RT Clocks
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.
Summary
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | GE Grid Solutions Reason RT Clocks | RT430, RT431, and RT434, all firmware versions prior to 08A05 | — | No fix listed | CNA |
- GE Grid Solutions Reason RT Clocks Vendor— Affected RT430, RT431, and RT434, all firmware versions prior to 08A05 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ge:rt430_firmware:*:*:*:*:*:*:*:* | before 08a05 | Vulnerable | GE |
| cpe:2.3:h:ge:rt430:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:rt431_firmware:*:*:*:*:*:*:*:* | before 08a05 | Vulnerable | GE |
| cpe:2.3:h:ge:rt431:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:rt434_firmware:*:*:*:*:*:*:*:* | before 08a05 | Vulnerable | GE |
| cpe:2.3:h:ge:rt434:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
- cpe:2.3:o:ge:rt430_firmware:*:*:*:*:*:*:*:* Versions before 08a05 Vulnerable ·GE
- cpe:2.3:h:ge:rt430:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:rt431_firmware:*:*:*:*:*:*:*:* Versions before 08a05 Vulnerable ·GE
- cpe:2.3:h:ge:rt431:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:rt434_firmware:*:*:*:*:*:*:*:* Versions before 08a05 Vulnerable ·GE
- cpe:2.3:h:ge:rt434:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-12017
- 2026-10-03 Alias added: GHSA-29xh-89xf-762p
References
More GE Rt430 Firmware vulnerabilities
- TI-2020-15439 GE Reason RT43X Clocks Code Injection CVSS 3.1CRITICAL 9.8
- TI-2020-15435 GE Reason RT43X Clocks Use of Hard-coded Cryptographic Key CVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-12017 · CVE Program
- CVE-2020-12017 · NVD
- FIRST EPSS
- GHSA-29xh-89xf-762p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences