Lucene search

IcscertCVELIST:CVE-2023-4487

HistorySep 05, 2023 - 10:55 p.m.

CVE-2023-4487 GE Digital CIMPLICITY Process Control

2023-09-0522:55:45

CWE-114

icscert

www.cve.org

ge digital

cimplicity

process control

vulnerability

local attacker

malicious configuration files

web server

privilege escalation

hmi software

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

0.4%

JSON

GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CIMPLICITY",
    "vendor": "GE Digital",
    "versions": [
      {
        "status": "affected",
        "version": "2023"
      }
    ]
  }
]

References

digitalsupport.ge.com/s/article/GE-Digital-CIMPLICITY-Privilege-Escalation-Vulnerability

www.cisa.gov/news-events/ics-advisories/icsa-23-243-02

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

0.4%

JSON

Related for CVELIST:CVE-2023-4487