CVE-2025-27254

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27254

8.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

C

WE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.

References
Link Resource
https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27254
Configurations

No configuration.

History

07 Oct 2025, 15:16

Type Values Removed Values Added
Summary (en) Improper Authentication vulnerability in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify. (en) CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.  The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify.
CWE CWE-287 CWE-282

12 Mar 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-10 09:15

Updated : 2025-10-07 15:16

NVD link : CVE-2025-27254

Mitre link : CVE-2025-27254

CVE.ORG link : CVE-2025-27254

JSON object : View

Products Affected

No product.

CWE
CWE-282

Improper Ownership Management