CVE-2014-5409
GE Hydran M2 Predictable Value Range from Previous Values
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Medium6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
| NVDNVD · Modified | 2.0 | Medium5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.7% · top 14% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.
Weakness
Affected products
GE · Hydran M2, containing the 17046 Ethernet option
- affected < October 2014
What to do
Solution: GE Digital Energy has released a new version of the Ethernet option, which resolves the identified vulnerability in newly released Hydran M2 devices. The update changes the sequence algorithm, which makes it improbable that a TCP sequence attack could succeed. The version of Ethernet card that implements this improvement is 94450214LFMT100SEM-L.R3-CL.
Workaround: There is no method to update Hydran M2 devices released prior to October 2014. GE Digital Energy recommends that utilities using older versions of the Hydran M2 device implement network security defensive measures, to include the following: • Place the Hydran M2 inside the control system network security perimeter with access controls and monitoring. • Minimize network exposure to all other control system devices. Control system devices should not directly face the Internet or business networks. • Locate control system networks and devices behind properly configured firewalls, and isolate them from the business network. • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. GE Digital Energy’s Product Bulletin is available in at the following location, with a user account: http://libraries.ge.com/download?fileid=642886573101&entity_id=31955841101&sid=101
References (4)
- https://www.cisa.gov/news-events/ics-advisories/icsa-15-041-02 (opens in a new tab)
- http://libraries.ge.com/download?fileid=642886573101&entity_id=31955841101&sid=101 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-041-02.json (opens in a new tab)
- https://ics-cert.us-cert.gov/advisories/ICSA-15-041-02 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .