Vulnerability · Published Sep 5, 2023 · Assigned by icscert
CVE-2023-4487GE Digital CIMPLICITY Process Control
High 7.8
In plain English
A high-severity security flaw in CIMPLICITY from GE Digital. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GE Digital | CIMPLICITY | 2023 |
Weakness: CWE-114 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H