CVE-2018-5475
📋 TL;DR
Multiple stack-based buffer overflow vulnerabilities in GE D60 Line Distance Relay devices allow remote attackers to execute arbitrary code. This affects industrial control systems running firmware version 7.11 and earlier, potentially compromising critical power grid infrastructure.
💻 Affected Systems
- GE D60 Line Distance Relay
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, manipulation of relay settings causing power grid instability or blackouts, and lateral movement to other industrial control systems.
Likely Case
Device crash/reboot causing temporary loss of protection functions, or limited code execution allowing data exfiltration or persistence mechanisms.
If Mitigated
Denial of service through device crash if network segmentation prevents code execution, with no impact to protected power lines.
🎯 Exploit Status
Buffer overflow vulnerabilities typically require crafting specific malformed packets. Industrial control system exploits often remain private due to critical infrastructure concerns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware Version 7.20 or later
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-046-02
Restart Required: Yes
Instructions:
1. Contact GE Grid Solutions for firmware update 7.20+. 2. Schedule maintenance window (relay will be offline during update). 3. Backup current configuration. 4. Apply firmware update following GE's procedures. 5. Restore configuration and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate D60 relays in dedicated network segments with strict firewall rules
Access Control Lists
allImplement strict IP-based access controls to limit which systems can communicate with relays
🧯 If You Can't Patch
- Implement network segmentation with industrial firewalls to isolate D60 devices
- Deploy intrusion detection systems monitoring for abnormal traffic patterns to/from relays
🔍 How to Verify
Check if Vulnerable:
Check firmware version via relay's web interface or serial console. Vulnerable if version is 7.11 or lower.Check Version:
Use relay's web interface (typically port 80) or serial console command 'VER' to display firmware versionVerify Fix Applied:
Confirm firmware version is 7.20 or higher after update. Test communication interfaces for stability.📡 Detection & Monitoring
Log Indicators:
- Multiple connection attempts to relay ports
- Unusual packet sizes to relay communication ports
- Relay reboot events without scheduled maintenance
Network Indicators:
- Abnormal traffic patterns to relay IPs (typically ports 80, 502, 20000)
- Malformed packets targeting known buffer overflow patterns
SIEM Query:
source_ip=* AND dest_ip=[relay_ip] AND (port=80 OR port=502 OR port=20000) AND bytes>threshold