CVE-2012-2516: OS Command Injection
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2516?
CVE-2012-2516 has a high severity due to its potential for remote code execution.
How do I fix CVE-2012-2516?
To fix CVE-2012-2516, users should update to the latest versions of the affected GE Intelligent Platforms software components.
Which software versions are affected by CVE-2012-2516?
CVE-2012-2516 affects GE Intelligent Platforms Proficy Historian versions 3.1, 3.5, 4.0, and 4.5, Proficy HMI/SCADA iFIX 5.0 and 5.1, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver versions 7.20 and 7.42.
What type of vulnerability is CVE-2012-2516?
CVE-2012-2516 is identified as a remote code execution vulnerability in an ActiveX control.
Is there a workaround for CVE-2012-2516 if I cannot update software?
As a temporary measure, users may consider disabling the ActiveX control in question to mitigate the risk associated with CVE-2012-2516.