CVE-2025-27256
Published: 10 March 2025
Description
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Security Summary
CVE-2025-27256 is a Missing Authentication for Critical Function vulnerability (CWE-306) in the GE Vernova Enervista UR Setup application. The flaw arises from a missing SSH server authentication mechanism, which allows authentication bypass. As a result, client connections to the application are not authenticated, enabling an attacker to perform a man-in-the-middle (MITM) attack on the network. The vulnerability carries a CVSS v3.1 base score of 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) and was published on 2025-03-10.
An attacker on an adjacent network (AV:A) can exploit this vulnerability with low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). By positioning themselves to intercept unauthenticated SSH connections, the attacker can conduct a MITM attack, achieving low confidentiality impact alongside high integrity (I:H) and availability (A:H) impacts on the targeted system.
Mitigation guidance is provided in advisories from the vendor and third-party researchers, including GE Vernova's security bulletin at https://www.gevernova.com/grid-solutions/app/DownloadFile.aspx?prod=urfamily&type=21&file=76 and Nozomi Networks' vulnerability advisory at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-27256. Security practitioners should review these resources for patching details and recommended workarounds.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE description explicitly indicates that the missing SSH server authentication enables a man-in-the-middle (MITM) attack on the network, directly mapping to the Adversary-in-the-Middle technique (T1557).