CVE-2022-23921: ge proficy_cimplicitiy Improper Privilege Management
Vulnerability summary
CVE-2022-23921 is a high (CVSS 7.8) Improper Privilege Management vulnerability in ge proficy_cimplicitiy. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.5% of scored vulnerabilities.
Timeline
- 25-02-2022PublishedVulnerability first disclosed.
- 16-04-2025Last modifiedVulnerability information updated.
Description
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA7.5HighCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ge1 product
- proficy_cimplicitiy≤ 11.1
General electric1 product
- proficy cimplicity≥ all, ≤ 11.1
2 vendors · 2 products
References
1 links
www.cisa.gov/uscert/ics/advisories/icsa-22-053-01X Refsource MISCThird Party AdvisoryUS Government Resource