CVE-2016-2310
📋 TL;DR
GE Multilink industrial switches have hardcoded credentials that allow remote attackers to modify configuration settings via the web interface. This affects multiple switch models with outdated firmware, potentially compromising industrial control systems.
💻 Affected Systems
- GE Multilink ML800
- ML1200
- ML1600
- ML2400
- ML810
- ML3000
- ML3100
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise allowing attackers to reconfigure switches, disrupt industrial operations, intercept traffic, or pivot to other critical systems.
Likely Case
Unauthorized configuration changes leading to network disruption, data interception, or denial of service in industrial environments.
If Mitigated
Limited impact if switches are isolated from untrusted networks and monitored for configuration changes.
🎯 Exploit Status
Exploitation requires only knowledge of hardcoded credentials and network access to web interface. No special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ML800/1200/1600/2400: 5.5.0 or later; ML810/3000/3100: 5.5.0k or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01
Restart Required: Yes
Instructions:
1. Download firmware update from GE authorized distributor. 2. Backup current configuration. 3. Upload new firmware via web interface or console. 4. Reboot switch. 5. Verify firmware version and test functionality.
🔧 Temporary Workarounds
Network segmentation
allIsolate switches from untrusted networks and restrict access to management interfaces.
Disable web interface
allDisable HTTP/HTTPS management if not required, use console or SSH instead.
configure terminal
no ip http server
no ip http secure-server
end
write memory
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach switch management interfaces
- Monitor for unauthorized configuration changes and failed login attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System > About) or CLI (show version). Compare against patched versions.Check Version:
show versionVerify Fix Applied:
Confirm firmware version is 5.5.0 or later for ML800/1200/1600/2400, or 5.5.0k or later for ML810/3000/3100.📡 Detection & Monitoring
Log Indicators:
- Unauthorized login attempts using default credentials
- Unexpected configuration changes
- Web interface access from unusual IPs
Network Indicators:
- HTTP/HTTPS traffic to switch management interfaces from unauthorized sources
- Configuration file transfers
SIEM Query:
source_ip IN (switch_management_ips) AND (event_type='login_failure' OR event_type='configuration_change')