CVE-2021-27418

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTML encoding of user-supplied strings.

• CWE-20
• CWE-79

• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
• https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02Mitigation, Third Party Advisory, US Government Resource
• https://www.gegridsolutions.com/Passport/Login.aspxPermissions Required, Vendor Advisory

Published

Mar 23, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27411Micrium OS Versions 5.10.1 and prior are vulnerable to integ…6.5
• CVE-2021-27412Delta Electronics DOPSoft Versions 4.0.10.17 and prior are v…7.8
• CVE-2021-27413Omron CX-One Versions 4.60 and prior, including CX-Server Ve…7.8
• CVE-2021-27414An attacker could trick a user of Hitachi ABB Power Grids El…6.1
• CVE-2021-27416An attacker could exploit this vulnerability in Hitachi ABB …5.4
• CVE-2021-27417eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vu…9.8
• CVE-2021-27419uClibc-ng versions prior to 1.0.37 are vulnerable to integer…9.8
• CVE-2021-27420GE UR firmware versions prior to version 8.1x web server tas…5.3
• CVE-2021-27421NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to…9.8
• CVE-2021-27422GE UR firmware versions prior to version 8.1x web server int…7.5
• CVE-2021-27424GE UR firmware versions prior to version 8.1x shares MODBUS …5.3
• CVE-2021-27425Cesanta Software Mongoose-OS v2.17.0 is vulnerable to intege…9.8