CVE-2018-5475 is a stack-based buffer overflow (CWE-121/CWE-787) in GE's D60 Line Distance Relay firmware, a protection relay that detects faults and issues trip commands on high-voltage transmission lines: a remote, unauthenticated attacker running firmware version 7.11 or earlier can send crafted input that overflows the stack, and NVD rates the resulting remote-code-execution impact 9.8 (critical) on CVSS v3.1.
Vulnerability summary
9.8
Critical
3.8%
EPSS score (FIRST)
No
CISA KEV catalog
2018-02-19
Published
Vulnerability ID: CVE-2018-5475 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| GE D60 Line Distance Relay | cpe:2.3:o:ge:d60_line_distance_relay_firmware:*:*:*:*:*:*:*:* | D60 Line Distance Relay firmware version 7.11 and prior, per CISA ICSA-18-046-02 |
What does this mean for affected devices?
CVE-2018-5475 (CWE-121 Stack-based Buffer Overflow, also mapped to CWE-787) affects the GE D60 Line Distance Relay, a protection device GE markets for detecting faults and tripping circuit breakers on high-voltage transmission lines to isolate faulted sections of the grid.
NVD's description states: "A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified, which may allow remote code execution" (NVD).
NVD records a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with full confidentiality, integrity and availability impact consistent with arbitrary code execution rather than a crash alone (NVD).
The flaw is tracked in CISA's ICS advisory ICSA-18-046-02 ("GE D60 Line Distance Relay"), published alongside a companion flaw, CVE-2018-5473 — an SSH-function buffer overflow in the same devices, also rated 9.8 — and both were reported to GE and ICS-CERT by a researcher at Kaspersky Lab, who published their own technical writeup of the issues (CISA ICSA-18-046-02, Kaspersky ICS-CERT).
Kaspersky's advisory states: "The newly identified issues have to do with multiple buffer overflow vulnerabilities (CVE-2018-5475) and an improper restriction of operations within the bounds of a memory buffer (CVE-2018-5473)" and that these vulnerabilities "were identified by a Kaspersky Lab researcher" (Kaspersky ICS-CERT).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 3.79% (90.1th percentile) as of 2026-11-08 — notably higher than most ICS CVEs in this corpus, consistent with its critical severity and age (CISA KEV, FIRST EPSS).
Operators running D60 relays on firmware 7.11 or earlier should update to a fixed release via GE's grid solutions portal and, per CISA's mitigation guidance, isolate relay control networks from corporate networks in the meantime, since remote code execution on a transmission-line protection relay could let an attacker disable protection or issue unauthorized trip commands.
Evidence
- A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior; multiple stack-based buffer overflow vulnerabilities may allow remote code execution. — NVD
- NVD Primary CVSS v3.1 score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- CVE-2018-5475 is documented in CISA ICS advisory ICSA-18-046-02, "GE D60 Line Distance Relay", alongside companion flaw CVE-2018-5473 in the device's SSH functions, both affecting the energy sector with worldwide deployment. — CISA ICSA-18-046-02
- These vulnerabilities were identified by a Kaspersky Lab researcher; Kaspersky's own ICS-CERT publication describes CVE-2018-5475 as multiple buffer overflow vulnerabilities and CVE-2018-5473 as an improper restriction of operations within memory buffer bounds. — Kaspersky ICS-CERT
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 3.79% (90.1th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What could an attacker actually do by exploiting CVE-2018-5475?
Send crafted network input that overflows the stack and executes arbitrary code on the D60 relay — not just a crash, but full remote code execution, consistent with NVD's confidentiality:high / integrity:high / availability:high scoring (per NVD).
Does exploiting this flaw require authentication or user interaction?
No. NVD's vector shows no privileges required (PR:N) and no user interaction (UI:N), meaning a remote, unauthenticated attacker can trigger code execution directly (per NVD).
Is CVE-2018-5475 the only flaw in this advisory?
No — CISA's advisory ICSA-18-046-02 also covers CVE-2018-5473, a separate buffer overflow in the D60's SSH functions that likewise allows remote code execution and is also rated 9.8 (per CISA ICSA-18-046-02).
Why is remote code execution on a line distance relay particularly serious?
The D60 is a protection relay that detects faults and issues trip commands to isolate faulted sections of a high-voltage transmission line; an attacker with code execution on the device could disable protection functions or issue unauthorized trip commands, directly affecting transmission-line and grid stability (per CISA ICSA-18-046-02, Kaspersky ICS-CERT).