CVE-2025-27257

MEDIUM EPSS 6.7%

Published Mar 10, 20251y ago · Modified Jun 17, 20261w ago

6.1 CVSS 3.1

Medium

Published Mar 10, 2025 1y ago

Last Modified Jun 17, 2026 1w ago

Description

Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. The firmware signature verification is enforced only on the client-side dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

CVSS Details

Base Score

6.1

Exploitability

0.9

Impact

5.2

Vector string

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Attack Vector Adjacent

Attack Complexity Low

Privileges Required High

User Interaction None

Scope Unchanged

Confidentiality None

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

6.7% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-345

References 2

gevernova.com https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
nozominetworks.com https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27257

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.