Ge Intelligent Platforms Proficy Hmi\/Scada Cimplicity vulnerabilities

10 vulnerabilities

Known vulnerabilities in Ge Intelligent Platforms Proficy Hmi\/Scada Cimplicity, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.3CriticalCVE-2013-2785ge · intelligent_platforms_proficy_hmi\/scada_cimplicity +1 morege intelligent_platforms_proficy_hmi\/scada_cimplicityMultiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.EPSS3.77%7.1HighCVE-2013-2811catapultsoftware · catapult_dnp3_i\/o_driver +3 morecatapultsoftware catapult_dnp3_i\/o_driverThe (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.EPSS1.85%4.7MediumCVE-2013-2823catapultsoftware · catapult_dnp3_i\/o_driver +3 morecatapultsoftware catapult_dnp3_i\/o_driverThe (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.EPSS0.76%4.3MediumCVE-2013-0653ge · intelligent_platforms_proficy_hmi\/scada_cimplicity +2 morege intelligent_platforms_proficy_hmi\/scada_cimplicityDirectory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.EPSS19.11%9.3CriticalCVE-2013-0654ge · intelligent_platforms_proficy_hmi\/scada_cimplicity +2 morege intelligent_platforms_proficy_hmi\/scada_cimplicityCimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.EPSS3.06%6.9MediumCVE-2014-2355ge · intelligent_platforms_proficy_hmi\/scada_cimplicity +1 moreGE Proficy HMI/SCADA CIMPLICITY CimViewThe (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.EPSS0.65%7.5HighCVE-2014-0751ge · intelligent_platforms_proficy_hmi\%2fscada_cimplicity +4 moreGE Proficy HMI/SCADA Path TraversalThe CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could allow the attacker to execute arbitrary code.EPSS3.08%7.5HighCVE-2014-0750ge · intelligent_platforms_proficy_hmi\%2fscada_cimplicity +4 moreGE Proficy HMI/SCADA Path TraversalDirectory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.EPSS69.83%4.3MediumCVE-2012-4689ge · intelligent_platforms_proficy_hmi\/scada_cimplicity +2 morege intelligent_platforms_proficy_hmi\/scada_cimplicityInteger overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.EPSS1.15%6.8MediumCVE-2017-12732ge · intelligent_platforms_proficy_hmi\/scada_cimplicityge intelligent_platforms_proficy_hmi\/scada_cimplicityA Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified, allowing a buffer overwrite that could lead to an arbitrary remote code execution.EPSS0.75%