{"schemaVersion":3,"id":"CVE-2014-0751","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The CIMPLICITY Web-based access component, CimWebServer, does not check\nthe location of shell files being loaded into the system. By modifying\nthe source location, an attacker could send shell code to the\nCimWebServer which would deploy the nefarious files as part of any SCADA\n project. This could allow the attacker to execute arbitrary code.","dates":{"published":"2014-01-25T22:00:00.000Z","modified":"2025-08-22T22:51:23.718Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03075,"percentile":0.87554,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.35700000000000004,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.02718},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02968,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02968,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.03075,"percentile":0.87554}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02718,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02968,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02968,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.03075,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.03075,"percentile":0.87554}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"ge","product":"intelligent_platforms_proficy_hmi\\%2fscada_cimplicity","name":"intelligent platforms proficy hmi\\%2fscada cimplicity","label":"intelligent_platforms_proficy_hmi\\%2fscada_cimplicity","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 8.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 8.2","eol":null,"hubHref":"/vendor/ge/intelligent_platforms_proficy_hmi2fscada_cimplicity"},{"vendor":"ge","product":"intelligent_platforms_proficy_hmi\\/scada_cimplicity","name":"intelligent platforms proficy hmi\\/scada cimplicity","label":"intelligent_platforms_proficy_hmi\\/scada_cimplicity","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.01","noFixRecorded":false,"fixedIn":null},{"text":"7.5","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"8.1","noFixRecorded":false,"fixedIn":null},{"text":"8.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.01 | 7.5 | 8.0 | 8.1 | 8.2","eol":null,"hubHref":"/vendor/ge/intelligent_platforms_proficy_hmiscada_cimplicity"},{"vendor":"ge","product":"intelligent_platforms_proficy_process_systems_with_cimplicity","name":"intelligent platforms proficy process systems with cimplicity","label":"intelligent_platforms_proficy_process_systems_with_cimplicity","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"na","noFixRecorded":false,"fixedIn":null}],"versionsText":"na","eol":null,"hubHref":"/vendor/ge/intelligent_platforms_proficy_process_systems_with_cimplicity"},{"vendor":"ge","product":"proficy hmi/scada - cimplicity","name":"Proficy HMI/SCADA - CIMPLICITY","label":"proficy hmi/scada - cimplicity","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.01, < 8.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.01, < 8.2","eol":null,"hubHref":"/vendor/ge/proficy_hmiscada_-_cimplicity"},{"vendor":"ge","product":"proficy process systems with cimplicity","name":"Proficy Process Systems with CIMPLICITY","label":"proficy process systems with cimplicity","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":"/vendor/ge/proficy_process_systems_with_cimplicity"}],"affectedCount":5,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01","label":"www.cisa.gov/news-events/ics-advisories/icsa-14-023-01","hostname":"www.cisa.gov","tags":[]},{"url":"http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939","label":"support.ge-ip.com/support/index?page=kbchannel&id=KB15939","hostname":"support.ge-ip.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/bid/65124","label":"www.securityfocus.com/bid/65124","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01","label":"ics-cert.us-cert.gov/advisories/ICSA-14-023-01","hostname":"ics-cert.us-cert.gov","tags":["X Refsource MISC","X Transferred"]},{"url":"http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940","label":"support.ge-ip.com/support/index?page=kbchannel&id=KB15940","hostname":"support.ge-ip.com","tags":["X Refsource CONFIRM","X Transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/65117","label":"www.securityfocus.com/bid/65117","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","X Transferred"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2014-01-25T22:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-08-22T22:51:23.718Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:04:44.277Z","stale":false,"partial":false}}