GE UR family input validation
Priority LOW 34CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Fixed UR family (GE): 8.1x
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| GE | UR family | before 8.1x | 8.1x | Patch available | CNA |
- UR family VendorGE Affected before 8.1x Fixed in 8.1x Patch available CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ge:multilin_b30_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_b30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_b90_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_b90:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_c60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_c60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_c70_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_c70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_c95_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_c95:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
- cpe:2.3:o:ge:multilin_b30_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_b30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_b90_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_b90:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_c60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_c60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_c70_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_c70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_c95_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_c95:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:ge:multilin_d30_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_d30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_d60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_d60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_f35_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_f35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_f60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_f60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_g30_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_g30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_g60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_g60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_l30_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_l30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_l60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_l60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_l90_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_l90:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_m60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_m60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_n60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_n60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_t35_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_t35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_t60_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_t60:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
| cpe:2.3:o:ge:multilin_c30_firmware:*:*:*:*:*:*:*:* | before 8.10 | Vulnerable | GE |
| cpe:2.3:h:ge:multilin_c30:-:*:*:*:*:*:*:* | not specified by NVD | Running on | GE |
- cpe:2.3:o:ge:multilin_d30_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_d30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_d60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_d60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_f35_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_f35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_f60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_f60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_g30_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_g30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_g60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_g60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_l30_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_l30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_l60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_l60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_l90_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_l90:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_m60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_m60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_n60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_n60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_t35_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_t35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_t60_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_t60:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
- cpe:2.3:o:ge:multilin_c30_firmware:*:*:*:*:*:*:*:* Versions before 8.10 Vulnerable ·GE
- cpe:2.3:h:ge:multilin_c30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·GE
Remediation
- Fix · CNA UR family (GE) Fixed in 8.1x
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
GE UR family 8.1x
6 records Highest priority Priority MEDIUM 3 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2021-08917 GE UR family Unrestricted Upload of File with Dangerous TypePriority MEDIUM 51
- TI-2021-08915 GE UR family insecure default variable initializationPriority MEDIUM 51
- TI-2021-08912 GE UR family exposure of sensitive information to an unauthorized actorPriority MEDIUM 40
Timeline
- 2026-10-02 Threatist record created from CVE-2021-27418
- 2026-10-03 Alias added: GHSA-xhjj-qrrg-5524
References
More GE Multilin B30 Firmware vulnerabilities
- TI-2021-08917 GE UR family Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
- TI-2021-08915 GE UR family insecure default variable initialization CVSS 3.1CRITICAL 9.8
- TI-2021-08912 GE UR family exposure of sensitive information to an unauthorized actor CVSS 3.1HIGH 7.5
- TI-2021-08913 GE UR family exposure of sensitive information to an unauthorized actor CVSS 3.1MEDIUM 5.3
- TI-2021-08910 GE UR family input validation CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-27418 · CVE Program
- CVE-2021-27418 · NVD
- FIRST EPSS
- GHSA-xhjj-qrrg-5524 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences