GE MultiLink Series Switch security updates

Number: AV16-090
Date: 3 June 2016

Purpose

The purpose of this advisory is to bring attention to Multilink Series firmware security updates released by General Electric.

Assessment

General Electric released firmware security updates for GE MultiLink Series switches to address a hard-coded credentials vulnerability VulnerabilityA flaw or weakness in the design or implementation of an information system or its environment that could be exploited to adversely affect an organization's assets or operations. . An attacker could remotely exploit this vulnerability by using the hard-coded factory password to gain full access to affected devices.

Affected versions:

GE ML800 Switch, firmware versions prior to Version 5.5.0,
GE ML810 Switch, firmware versions prior to Version 5.5.0k,
GE ML1200 Switch, firmware versions prior to Version 5.5.0,
GE ML1600 Switch, firmware versions prior to Version 5.5.0,
GE ML2400 Switch, firmware versions prior to Version 5.5.0,
GE ML3000 Switch, firmware versions prior to Version 5.5.0k, and
GE ML3100 Switch, firmware versions prior to Version 5.5.0k.

CVE Reference: CVE-2016-2310