CVE-2022-24119
published 2022-12-26CVE-2022-24119: Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.73%
49.6th percentile
Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ge | inet_900_firmware | < 8.3.0 | 8.3.0 |
| ge | inet_ii_900_firmware | < 8.3.0 | 8.3.0 |
| ge | sd1_firmware | <= 6.4.7 | — |
| ge | sd2_firmware | < 6.4.7 | 6.4.7 |
| ge | sd4_firmware | < 6.4.7 | 6.4.7 |
| ge | sd9_firmware | < 6.4.7 | 6.4.7 |
| ge | td220max_firmware | < 1.2.6 | 1.2.6 |
| ge | td220x_firmware | < 2.0.16 | 2.0.16 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
General Electric Renewable Energy MDS Radios
cisa_ics·2022-05-27·CVSS 8.1
[HIGH] General Electric Renewable Energy MDS Radios
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
General Electric Renewable Energy MDS Radios
Last RevisedMay 27, 2022
Alert CodeICSA-22-090-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: General Electric Renewable Energy
- Equipment: MDS iNET/iNET II/SD/TD220/TD220MAX Radios
- Vulnerabilities: Improper Input Validation, Hidden Functionality, Inadequate Encryption Strength, Uncontrolled Resource Consumption, Plaintext Storage of a Password, Download of Code Without Integrity Check
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allo
VulDB
General Electric iNET/iNET II up to 8.2.x Device Configuration Shell backdoor (icsa-22-090-06 / EUVD-2022-29031)
vuldb·2026-05-02·CVSS 9.8
CVE-2022-24119 [CRITICAL] General Electric iNET/iNET II up to 8.2.x Device Configuration Shell backdoor (icsa-22-090-06 / EUVD-2022-29031)
A vulnerability categorized as critical has been discovered in General Electric iNET and iNET II up to 8.2.x. The impacted element is an unknown function of the component Device Configuration Shell. Executing a manipulation can lead to backdoor.
The identification of this vulnerability is CVE-2022-24119. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
GHSA-wh9v-9x96-v32x: Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell
ghsa_unreviewed·2022-12-26
CVE-2022-24119 [CRITICAL] CWE-829 GHSA-wh9v-9x96-v32x: Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell
Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET and iNET II before 8.3.0.
No detection rules found.
No public exploits indexed.
2022-12-26
Published