CVE-2014-5409 json
GE Hydran M2 Predictable Value Range from Previous Values
published 2015-03-14 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-5297
- cvss
- 6.4
- version 2.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
The 17046 Ethernet card before 94450214LFMT100SEM-L.R3-CL for the GE Digital Energy Hydran M2 does not properly generate random values for TCP Initial Sequence Numbers (ISNs), which makes it easier for remote attackers to spoof packets by predicting these values.
Patch / fix
- GE Hydran M2, containing the 17046 Ethernet option October 2014
Exploit prediction
2.72% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:N/A:P |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- GE Hydran M2, containing the 17046 Ethernet option
Classification
- Weakness
-
- CWE-343 Predictable Value Range from Previous Values
References
- cisa.gov /news-events/ics-advisories/icsa-15-041-02
- libraries.ge.com /download?fileid=642886573101&entity_id=31955841101&sid=101
- github.com /cisagov/CSAF/blob/develop/csaf_files/OT/white/2015/icsa-15-041-02.json
-
ics-cert.us-cert.gov
/advisories/ICSA-15-041-02
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2014-5409
- NVD CVE-2014-5409
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.