Vulnerability · Published Apr 15, 2020 · Assigned by icscert

CVE-2020-6992

Medium 6.7

In plain English

A medium-severity privilege mismanagement in GE Digital CIMPLICITY. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS NVD)6.7Medium

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product v10.0 and prior. If exploited, this vulnerability could allow an adversary to modify the system, leading to the arbitrary execution of code. This vulnerability is only exploitable if an attacker has access to an authenticated session. GE Digital CIMPLICITY v11.0, released January 2020, contains mitigation for this local privilege escalation vulnerability. GE Digital recommends all users upgrade to GE CIMPLICITY v11.0 or newer.

Affected products (as reported)

Vendor	Product	Versions
n/a	GE Digital CIMPLICITY	v10.0 and prior

Weakness: CWE-269

References

https://www.us-cert.gov/ics/advisories/icsa-20-098-02 x_refsource_MISC