CVE-2023-4487: GE Digital CIMPLICITY Process Control
Published Sep 5, 2023
·Updated
GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.
Affected Software
2 affected components
GE Digital CIMPLICITY=2023
GE CIMPLICITY=2023
Remediation
Information
GE Digital recommends users apply the following mitigations:
* Update CIMPLICITY to v2023 SIM 1 https://digitalsupport.ge.com/s/article/CIMPLICITY-2023-SIM-1 (login is required)
Please refer to GE Digital’s security bulletin https://digitalsupport.ge.com/s/article/GE-Digital-CIMPLICITY-Privilege-Escalation-Vulnerability (login is required) for more information.
Event History
Sep 5, 2023
CVE Published
via MITRE·10:55 PM
Data Sourced
via MITRE·10:55 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the CVE ID?
The CVE ID is CVE-2023-4487.
2
What is the title of the vulnerability?
The title of the vulnerability is 'GE CIMPLICITY 2023 Process Control Vulnerability'.
3
What is the severity of this vulnerability?
The severity of this vulnerability is high with a CVSS score of 7.8.
4
How does this vulnerability occur?
This vulnerability allows a local attacker to insert malicious configuration files in the expected web server execution path of GE CIMPLICITY 2023, escalating privileges and gaining full control of the HMI software.
5
How can I fix this vulnerability?
To fix this vulnerability, it is recommended to apply the latest security patches and updates provided by GE.