CVE-2021-27418 GE UR family input validation

Medium 5.3 Published 23 Mar 2022 Updated 16 Apr 2025

Attackers can inject malicious scripts via the web interface due to insufficient input validation and missing HTML encoding in GE UR firmware.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-27418?

CVE-2021-27418 is a medium-severity cross-site scripting vulnerability in GE UR family, published on 23 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.

Weakness: CWE-79, CWE-20

Which versions are affected by CVE-2021-27418?

It affects 19 products.

Products include Ge Multilin B30 Firmware, Ge Multilin B90 Firmware, Ge Multilin C30 Firmware, Ge Multilin C60 Firmware, Ge Multilin C70 Firmware, Ge Multilin C95 Firmware and 13 more.

How do I fix CVE-2021-27418?

No fix has been published for CVE-2021-27418 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-27418 being exploited?

There is no known exploitation of CVE-2021-27418 in the wild and no public exploit code.

Sources

Also known as GHSA-xhjj-qrrg-5524.