Unscored severity · published Jul 31, 2013
CVE-2013-2785
Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2…
–
CVSS
3.8%
EPSS
No
On KEV
Description
Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Intelligent Platforms Proficy Hmi/scada Cimplicity · GE
8.0; 8.1; 8.2 · source: NVD
IP
Intelligent Platforms Proficy Process Systems With Cimplicity · GE
All versions, or not specified · source: NVD
Affected product
IP
Intelligent Platforms Proficy Hmi/scada Cimplicity
GE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2785
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2785
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-13-170-01
support.ge-ip.com
http://support.ge-ip.com/support/index?page=kbchannel&id=KB15602
More from Intelligent Platforms Proficy Hmi/scada Cimplicity
6.8
CVE-2017-12732
A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior
–
CVE-2014-2355
The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM)…
–
CVE-2014-0751
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system
–
CVE-2014-0750
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process…
–
CVE-2013-2823
The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station…