CVE-2025-27257

Name of the Vulnerable Software and Affected Versions GE Vernova UR IED family devices (affected versions not specified)

Description The issue concerns an Insufficient Verification of Data Authenticity, which enables an authenticated user to install modified firmware. This is possible because firmware signature verification is only enforced on the client-side by the dedicated software Enervista UR Setup, allowing the integration check to be bypassed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.