Today, CISA’s NCCIC-ICS published a control system security advisory for products from GE Gas Power.
GE Advisory
This advisory describes two vulnerabilities in the GE Gas Power ToolBoxST software platform. One of the vulnerabilities is a third-party (npm, see link below) vulnerability. The vulnerabilities were reported by Sharon Briznov of Claroty. GE has new versions that mitigate the vulnerabilities. There is no indication that Briznov has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Improper restriction of XML external reference entity reference - CVE-2021-44477, and
Path traversal - CVE-2018-16202
NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit the vulnerabilities to result in data exfiltration or arbitrary write, overwrite, and execution.
NOTE: GE Gas Power also published a Log4Shell advisory on the day they published the base advisory for these vulnerabilities. I will have further details on my Public ICS Disclosure post this weekend.