CVE-2022-23921: ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
First published: Fri Feb 25 2022(Updated: )
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ge Proficy Cimplicitiy | <=11.1 | |
| GE Proficy CIMPLICITIY v11.1 and prior versions |
Remedy
GE Digital recommends users upgrade all instances of the affected software to GE Digital’s Proficy CIMPLICITY, released January 2022 (Upgrade) and follow the instructions in the Secure Deployment Guide to restrict which CIMPLICITY projects are allowed to run. The upgrade contains what GE believes are mitigation measures to help ensure the vulnerability cannot be exploited. Users are encouraged to contact a GE Digital representative for the latest versions of the update. For users who choose to not implement the upgrade, GE Digital recommends applying the instructions in CIMPLICITY’s Secure Deployment Guide to ensure access to the CIMPLICITY machines and directories are properly controlled via access control limits.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-23921.
What is the severity of CVE-2022-23921?
The severity of CVE-2022-23921 is high (7.8).
What is the affected software of CVE-2022-23921?
The affected software of CVE-2022-23921 is GE Proficy Cimplicitiy version 11.1.
What are the potential consequences of CVE-2022-23921?
Exploitation of CVE-2022-23921 may result in local privilege escalation and code execution.
How can CVE-2022-23921 be exploited?
CVE-2022-23921 can be exploited if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the system environment supports code execution.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/severity
- agent/references
- agent/tags
- agent/event
- agent/softwarecombine
- collector/ics-cert-advisory
- source/ICS
- agent/software-canonical-lookup
- vendor/ge
- canonical/ge proficy cimplicitiy
- version/ge proficy cimplicitiy/11.1
- canonical/ge proficy cimplicitiy v11.1 and prior versions