CVE-2019-6548
📋 TL;DR
GE Communicator versions prior to 4.0.517 contain two hardcoded backdoor accounts that allow attackers to gain full control over the database. This affects all users running vulnerable versions of GE Communicator. The service is protected by default Windows firewall settings, limiting exposure.
💻 Affected Systems
- GE Communicator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the GE Communicator database, allowing attackers to modify, delete, or exfiltrate sensitive industrial control system data, potentially disrupting operations.
Likely Case
Unauthorized access to the database by attackers who can reach the service, leading to data theft or manipulation if firewall rules are misconfigured.
If Mitigated
Minimal impact if Windows firewall blocks external access and proper network segmentation is in place, though internal threats remain.
🎯 Exploit Status
Exploitation is straightforward using the hardcoded credentials if network access is available; no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.517
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-19-122-02
Restart Required: Yes
Instructions:
1. Download GE Communicator version 4.0.517 or later from GE Digital. 2. Install the update following vendor instructions. 3. Restart the system to apply changes.
🔧 Temporary Workarounds
Block Service Ports with Firewall
windowsConfigure Windows firewall or network firewalls to block inbound connections to GE Communicator service ports.
netsh advfirewall firewall add rule name="Block GE Communicator" dir=in action=block protocol=TCP localport=<port_number>
Network Segmentation
allIsolate GE Communicator systems on a separate network segment with strict access controls.
🧯 If You Can't Patch
- Ensure Windows firewall is enabled and configured to block all inbound connections to GE Communicator ports.
- Implement strict network access controls and monitor for unauthorized access attempts to the service.
🔍 How to Verify
Check if Vulnerable:
Check GE Communicator version in the application interface or installation directory; versions below 4.0.517 are vulnerable.Check Version:
Check application properties or consult GE Digital documentation for version details.Verify Fix Applied:
Confirm GE Communicator version is 4.0.517 or higher after patching and verify no unauthorized accounts exist in the database.📡 Detection & Monitoring
Log Indicators:
- Failed or successful login attempts using hardcoded account names in GE Communicator logs
- Unusual database access patterns
Network Indicators:
- Inbound connections to GE Communicator service ports from unauthorized IPs
- Traffic patterns indicating database queries or modifications
SIEM Query:
source="GE Communicator" AND (event_type="login" AND (username="backdoor_account1" OR username="backdoor_account2"))