GE.MDS.PulseNET.Hidden.Account.Remote.Code.Execution

Description

This indicates an attack attempt to exploit a Remote Code Execution vulnerability in GE MDS PulseNET.
The vulnerability is due to hard coded default credential inside the vulnerable application. A remote attacker can exploit this to authenticate with the application as an administrator and eventually execute arbitrary command within the context of the affected application.

Affected Products

General Electric MDS PulseNET 3.1.3 and prior
General Electric MDS PulseNET Enterprise 3.1.3 and prior

Impact

System Compromise: Remote attackers can gain control of vulnerable systems

Recommended Actions

Apply the most recent upgrade or patch from the vendor.
http://www.gedigitalenergy.com/app/resources.aspx?prod=pulsenet&type=9

References