Emerson Electric Proficy Machine Edition vulnerabilities
6 vulnerabilities
Known vulnerabilities in Emerson Electric Proficy Machine Edition, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-2788emerson electricproficy machine edition+1
EPSS score0.24%
Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.CVE-2022-2793emerson electricproficy machine edition+1EPSS score0.14%
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.CVE-2022-2790emerson electricproficy machine edition+1EPSS score0.13%
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).CVE-2022-2791emerson electricproficy machine edition+1EPSS score0.18%
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.CVE-2022-2792emerson electricproficy machine edition+1EPSS score0.42%
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.CVE-2022-2789emerson electricproficy machine edition+1EPSS score0.12%
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled logic.