CVE-2022-24116
published 2022-12-26CVE-2022-24116: Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.29%
20.7th percentile
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ge | inet_900_firmware | < 8.3.0 | 8.3.0 |
| ge | inet_ii_900_firmware | < 8.3.0 | 8.3.0 |
| ge | sd1_firmware | <= 6.4.7 | — |
| ge | sd2_firmware | < 6.4.7 | 6.4.7 |
| ge | sd4_firmware | < 6.4.7 | 6.4.7 |
| ge | sd9_firmware | < 6.4.7 | 6.4.7 |
| ge | td220max_firmware | < 1.2.6 | 1.2.6 |
| ge | td220x_firmware | < 2.0.16 | 2.0.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
General Electric iNET/iNET II up to 8.2.x inadequate encryption (icsa-22-090-06 / EUVD-2022-29028)
vuldb·2026-05-02·CVSS 9.8
CVE-2022-24116 [CRITICAL] General Electric iNET/iNET II up to 8.2.x inadequate encryption (icsa-22-090-06 / EUVD-2022-29028)
A vulnerability, which was classified as problematic, has been found in General Electric iNET and iNET II up to 8.2.x. This vulnerability affects unknown code. The manipulation leads to inadequate encryption strength.
This vulnerability is documented as CVE-2022-24116. The attack requires being on the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-qc34-rvrg-f2q8: Certain General Electric Renewable Energy products have inadequate encryption strength
ghsa_unreviewed·2022-12-26
CVE-2022-24116 [CRITICAL] CWE-325 GHSA-qc34-rvrg-f2q8: Certain General Electric Renewable Energy products have inadequate encryption strength
Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0.
CISA ICS
General Electric Renewable Energy MDS Radios
cisa_ics·2022-05-27·CVSS 8.1
[HIGH] General Electric Renewable Energy MDS Radios
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
General Electric Renewable Energy MDS Radios
Last RevisedMay 27, 2022
Alert CodeICSA-22-090-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: General Electric Renewable Energy
- Equipment: MDS iNET/iNET II/SD/TD220/TD220MAX Radios
- Vulnerabilities: Improper Input Validation, Hidden Functionality, Inadequate Encryption Strength, Uncontrolled Resource Consumption, Plaintext Storage of a Password, Download of Code Without Integrity Check
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allo
No detection rules found.
No public exploits indexed.
2022-12-26
Published