Critical GE Vernova ICS Flaw (CVE-2025-3222, CVSS 9.3) Allows Authentication Bypass in Smallworld Master File Server

GE Vernova’s Electrification Software division has released a critical advisory for Smallworld Master File Server (SWMFS), detailing a high-severity authentication vulnerability (CVE-2025-3222) with a CVSS v4.0 score of 9.3 that could enable an authentication bypass in certain deployments. The flaw affects Smallworld deployments from v3.0.0 up to v5.3.3 (Linux) and up to v5.3.4 (Windows).

According to GE Vernova, exploitation requires a user with knowledge of the system, the underlying protocol, and the rights associated to users with already provisioned access, meaning the attack is not remotely exploitable by unauthenticated outsiders but could be abused by insiders or compromised accounts. The issue has been fully resolved in v5.3.4 for Linux and v5.3.5 for Windows, and GE Vernova urges customers to upgrade to these fixed releases as the most complete method to address the vulnerability.

Given Smallworld’s OT and ICS usage, the advisory emphasises secure deployment, strong access management, and defence-in-depth strategies such as network segmentation.