CVE-2022-24117
published 2022-12-26CVE-2022-24117: Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7…
PriorityP349critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.35%
27.2th percentile
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ge | inet_900_firmware | < 8.3.0 | 8.3.0 |
| ge | inet_ii_900_firmware | < 8.3.0 | 8.3.0 |
| ge | sd1_firmware | <= 6.4.7 | — |
| ge | sd2_firmware | < 6.4.7 | 6.4.7 |
| ge | sd4_firmware | < 6.4.7 | 6.4.7 |
| ge | sd9_firmware | < 6.4.7 | 6.4.7 |
| ge | td220max_firmware | < 1.2.6 | 1.2.6 |
| ge | td220x_firmware | < 2.0.16 | 2.0.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
General Electric MDS iNET/iNET II/SD/TD220/TD220MAX Firmware code download (icsa-22-090-06 / EUVD-2022-29029)
vuldb·2026-05-02·CVSS 9.8
CVE-2022-24117 [CRITICAL] General Electric MDS iNET/iNET II/SD/TD220/TD220MAX Firmware code download (icsa-22-090-06 / EUVD-2022-29029)
A vulnerability labeled as problematic has been found in General Electric MDS iNET, iNET II, SD, TD220 and TD220MAX. This impacts an unknown function of the component Firmware Handler. The manipulation results in download of code without integrity check.
This vulnerability is identified as CVE-2022-24117. The attack can be executed remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
GHSA-99g2-72rh-xfmr: Certain General Electric Renewable Energy products download firmware without an integrity check
ghsa_unreviewed·2022-12-26
CVE-2022-24117 [CRITICAL] CWE-494 GHSA-99g2-72rh-xfmr: Certain General Electric Renewable Energy products download firmware without an integrity check
Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.
CISA ICS
General Electric Renewable Energy MDS Radios
cisa_ics·2022-05-27·CVSS 8.1
[HIGH] General Electric Renewable Energy MDS Radios
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
General Electric Renewable Energy MDS Radios
Last RevisedMay 27, 2022
Alert CodeICSA-22-090-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: General Electric Renewable Energy
- Equipment: MDS iNET/iNET II/SD/TD220/TD220MAX Radios
- Vulnerabilities: Improper Input Validation, Hidden Functionality, Inadequate Encryption Strength, Uncontrolled Resource Consumption, Plaintext Storage of a Password, Download of Code Without Integrity Check
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allo
No detection rules found.
No public exploits indexed.
2022-12-26
Published