Read the docs
TI-2025-20104 Aliases CVE-2025-27257GHSA-5v9q-jpv7-7w2m

Insufficient verification of data authenticity in GE Vernova N60 multilin

Priority LOW 26CWE-345Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GE VernovaN60 multilin7.0 – 8.60—No fix listedCNA
GE VernovaB30 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaB90 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaC30 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaC60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaC70 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaC95 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaD30 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaD60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaF35 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaF60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaG30 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaG60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaL30 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaL60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaL90 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaM60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaT35 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaT60 Multilin7.0 – 8.60—No fix listedCNA
GE VernovaM60 Multilin7.0 – 8.60—No fix listedCNA
  • N60 multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • B30 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • B90 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • C30 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • C60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • C70 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • C95 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • D30 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • D60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • F35 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • F60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • G30 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • G60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • L30 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • L60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • L90 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • M60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • T35 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • T60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA
  • M60 Multilin VendorGE Vernova Affected 7.0 – 8.60 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27257
  2. 2026-10-03 Alias added: GHSA-5v9q-jpv7-7w2m

References

Other 2

  • TI-2025-02821 Smallworld SWMFS Improper Authentication CVSS 4.0CRITICAL 9.3
  • TI-2025-20103 Missing authentication in GE Vernova EnerVista UR Setup CVSS 3.1HIGH 8.3
  • TI-2025-20102 Hard-coded credentials in GE Vernova EnerVista UR Setup CVSS 3.1HIGH 8.0
  • TI-2025-20101 CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows… CVSS 3.1HIGH 8.0
  • TI-2025-08283 S1 Agile Privilege Escalation CVSS 4.0HIGH 7.5
  • TI-2025-07045 Smallworld SWMFS Arbitrary File Ops CVSS 4.0MEDIUM 5.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences