GE MDS PulseNET and MDS PulseNET Enterprise
Plan Patch7.3ICS-CERT ICSA-18-151-02May 31, 2018
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
GE PulseNET and PulseNET Enterprise versions 3.2.1 and earlier contain authentication bypass and XML external entity (XXE) injection vulnerabilities. The product fails to properly validate user credentials (CWE-287), allowing unauthenticated access to administrative functions. Additionally, improper XML parsing (CWE-611) enables attackers to read arbitrary files or execute code on the host server. Path traversal issues (CWE-23) may also allow access to restricted files. Exploitation requires only network connectivity to the PulseNET web interface and can result in privilege escalation and data theft.
What this means
What could happen
An attacker could exploit authentication flaws and XML parsing issues to gain elevated privileges on the PulseNET server and steal sensitive data like user credentials or system information from utility operators and assets.
Who's at risk
Electric utilities and energy organizations operating GE PulseNET or PulseNET Enterprise for SCADA data aggregation, reporting, or network monitoring. This affects anyone relying on PulseNET to monitor and manage distribution or transmission equipment across substations and field devices.
How it could be exploited
An attacker on the network sends specially crafted requests to the PulseNET web interface, exploiting missing or weak authentication checks (CWE-287) to bypass login controls. They then send malicious XML payloads (CWE-611) to trigger information disclosure or further privilege escalation, allowing command execution or data exfiltration from the host server.
Prerequisites
- Network access to the PulseNET web server (default HTTP/HTTPS port)
- No valid credentials required for initial exploitation
- PulseNET version 3.2.1 or earlier running on vulnerable configuration
remotely exploitableno authentication requiredlow complexityno patch available for versions 3.2.1 and earlieraffects energy sector infrastructure
Exploitability
Moderate exploit probability (EPSS 5.5%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
PulseNET Enterprise:≤ 3.2.14.1
PulseNET:≤ 3.2.14.1
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDRestrict network access to the PulseNET server to only authorized engineering workstations and control center terminals using firewall rules
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate PulseNET to version 4.1 or newer immediately
Long-term hardening
0/2HARDENINGImplement physical access controls to limit who can access the PulseNET server hardware
HARDENINGDedicate the PulseNET server to the PulseNET application only; do not run other services or applications on the same host
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/30b5b1e9-7977-4dc9-9299-5ea0e1d22e0a