GE Proficy HMISCADA CIMPLICITY 8.2 - Local Privilege Escalation

GE Proficy HMISCADA CIMPLICITY 8.2 - Local Privilege Escalation / Exploit Title: GE Proficy HMI/SCADA CIMPLICITY 8.2 Local Privilege Escalation Exploit0 day Vulnerability Discovery and Exploit Author: Zhou Yu Email: Version: 8.2 Tested on: Windows 7 SP1 X32 CVE : None Vulnerability Description:...

GE Proficy HMI SCADA CIMPLICITY Privilege Management Vulnerability

OVERVIEW Zhou Yu of Acorn Network Security identified an improper privilege management vulnerability and recently released exploit code for the GE Proficy HMI/SCADA CIMPLICITY application without coordination with ICS-CERT, the vendor, or any other coordinating entity known to ICS-CERT. GE produc...

Multiple Local Buffer Overflow Vulnerabilities in GE Proficy HMI/SCADA-CIMPLICITY

GE Intelligent Platforms' Proficy HMI/SCADA-iFIX is the world's leading industrial automation software solution that provides process visualization, data acquisition and data monitoring of manufacturing operations. Multiple local buffer overflow vulnerabilities exist in GE Proficy...

Code injection

The 1 CimView and 2 CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen aka .CIM file...

CVE-2014-2355

The 1 CimView and 2 CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen aka .CIM file...

CVE-2014-2355 GE Proficy HMI/SCADA CIMPLICITY CimView

The 1 CimView and 2 CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen aka .CIM file...

CVE-2014-2355

The CVE-2014-2355 vulnerability affects GE Proficy HMI/SCADA–CIMPLICITY CimView and CimEdit components (versions 8.2 and earlier). The issue is a memory access violation when processing CIMPLICITY screen files (.CIM), potentially enabling privilege escalation within the application. Publicly disc...

CVE-2014-2355: Improper Restriction of Operations within the Bounds of a Memory Buffer

The 1 CimView and 2 CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen aka .CIM file...

GE Proficy Vulnerabilities

OVERVIEW Researchers amisto0x07 and Z0mb1E of Zero Day Initiative ZDI have identified two vulnerabilities in the General Electric GE Proficy human-machine interface/supervisory control and data acquisition HMI/SCADA - CIMPLICITY application. GE has released security advisories, GEIP13-05 and...

GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation

OVERVIEW This advisory was originally posted to the NCCIC/US-CERT secure Portal library on October 16, 2014, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Said Arfi has identified a memory access violation vulnerability in GE’s CIMPLICITY CimView application. GE has...

GE Proficy CIMPLICITY gefebt.exe Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Auxiliary::Report include Msf::Exploit::E...

GE Proficy CIMPLICITY gefebt.exe Remote Code Execution

This Metasploit module abuses the gefebt.exe component in GE Proficy CIMPLICITY, reachable through the CIMPLICIY CimWebServer. The vulnerable component allows to execute remote BCL files in shared resources. An attacker can abuse this behaviour to execute a malicious BCL and drop an arbitrary EXE...

GE Proficy CIMPLICITY - 'gefebt.exe' Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'GE Proficy CIMPLICITY gefebt.exe Remote Code Execution', 'Description' = %q This module abuses the gefebt.exe component in GE Proficy...

GE Proficy CIMPLICITY gefebt.exe Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'GE Proficy CIMPLICITY gefebt.exe Remote Code Execution', 'Description' = %q This module abuses the gefebt.exe component in GE Proficy...

GE Proficy CIMPLICITY CimWebServer File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy CIMPLICITY. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CimWebServer component. This component performs insufficient parameter...

GE Proficy CIMPLICITY gefebt.exe File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy CIMPLICITY. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gefebt.exe component. This component performs insufficient parameter...

GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY gefebt.exe目录遍历漏洞

CVECAN ID: CVE-2014-0750 GE Proficy CIMPLICITY是客户端/服务器业务可视化和控制解决方案。 GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 8.2 SIM 24之前版本中，WebView CimWeb组件及Proficy Process Systems在实现上存在目录遍历漏洞，远程攻击者通过特制的消息，利用此漏洞可执行任意代码。 0 ge-ip Proficy CIMPLICITY 8.2 SIM 24 厂商补丁： ge-ip -----...

GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY CimWebServer.exe目录遍历漏洞

CVECAN ID: CVE-2014-0751 GE Proficy CIMPLICITY是客户端/服务器业务可视化和控制解决方案。 GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 8.2 SIM 24之前版本中，CimWebServer.exe（即组件WebView）及Proficy Process Systems在实现上存在目录遍历漏洞，远程攻击者通过向TCP端口10212发送特制的消息，利用此漏洞可执行任意代码。 0 ge-ip Proficy CIMPLICITY 8.2 SIM 24 厂商补丁： ge-ip...

Directory traversal

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-16...

CVE-2014-0750 GE Proficy HMI/SCADA Path Traversal

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-16...