Unscored severity · published Jul 5, 2012
CVE-2012-2516
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy…
–
CVSS
39.7%
EPSS
No
On KEV
Description
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)39.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Intelligent Platforms Proficy Batch Execution · GE
5.6 · source: NVD
IP
Intelligent Platforms Proficy Historian · GE
3.1; 3.5; 4.0; 4.5 · source: NVD
IP
Intelligent Platforms Proficy Hmi/scada Ifix · GE
5.0; 5.1 · source: NVD
IP
Intelligent Platforms Proficy Pulse · GE
1.0 · source: NVD
IP
Intelligent Platforms Si7 I/o Driver · GE
7.20; 7.42 · source: NVD
Affected product
IP
Intelligent Platforms Proficy Batch Execution
GE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2516
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2516
Vendor Advisory
http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf
More from Intelligent Platforms Proficy Batch Execution
–
CVE-2012-2515
Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC…