CVE-2012-6663

published 2020-01-23

CVE-2012-6663: General Electric D20ME devices are not properly configured and reveal plaintext passwords.

Priority P2 59 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

General Electric D20ME devices are not properly configured and reveal plaintext passwords.

Detection & IOCs extracted from sources · hover to see the quote

other TFTP↗

• → Monitor for unauthenticated TFTP requests targeting GE D20ME devices, which may indicate an attacker retrieving plaintext credential configuration files. ↗
• → Alert on TFTP traffic to/from GE D20ME ICS devices; successful retrieval of configuration files exposes usernames, passwords, and authentication levels in plaintext. ↗

• · Vulnerability affects GE D20ME devices and possibly other units in the D200 series; scope of affected hardware may be broader than confirmed. ↗
• · Credentials (username, password, authentication level) are stored and transmitted in plaintext within the TFTP-accessible configuration, meaning no decryption or cracking is required by an attacker. ↗

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-522