CVE-2022-24117 Supply chain in n/a

Critical 9.8 Published 26 Dec 2022 Updated 11 Apr 2025

Attackers can inject malicious firmware into GE Renewable Energy devices due to missing integrity checks during downloads, potentially compromising device operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-24117?

CVE-2022-24117 is a critical vulnerability in n/a, published on 26 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6.

Weakness: CWE-494

Which versions are affected by CVE-2022-24117?

It affects 8 products.

Products include Ge Inet 900 Firmware, Ge Inet Ii 900 Firmware, Ge Sd1 Firmware, Ge Sd2 Firmware, Ge Sd4 Firmware, Ge Sd9 Firmware and 2 more.

How do I fix CVE-2022-24117?

No fix has been published for CVE-2022-24117 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-24117 being exploited?

There is no known exploitation of CVE-2022-24117 in the wild and no public exploit code.

Sources

Also known as GHSA-99g2-72rh-xfmr.