Unscored severity · published Jan 25, 2014
CVE-2014-0751
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system
–
CVSS
3.1%
EPSS
No
On KEV
Description
The CIMPLICITY Web-based access component, CimWebServer, does not check
the location of shell files being loaded into the system. By modifying
the source location, an attacker could send shell code to the
CimWebServer which would deploy the nefarious files as part of any SCADA
project. This could allow the attacker to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Intelligent Platforms Proficy Hmi%2fscada Cimplicity · GE
through 8.2 · source: NVD
IP
Intelligent Platforms Proficy Hmi/scada Cimplicity · GE
4.01; 7.5; 8.0; 8.1; 8.2 · source: NVD
IP
Intelligent Platforms Proficy Process Systems With Cimplicity · GE
All versions, or not specified · source: NVD
Affected product
IP
Intelligent Platforms Proficy Hmi%2fscada Cimplicity
GE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0751
support.ge-ip.com
http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939
www.securityfocus.com
http://www.securityfocus.com/bid/65124
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01
ics-cert.us-cert.gov
http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01
Vendor Advisory
http://support.ge-ip.com/support/index?page=kbchannel&id=KB15940
www.securityfocus.com
http://www.securityfocus.com/bid/65117
More from Intelligent Platforms Proficy Hmi%2fscada Cimplicity
–
CVE-2014-0750
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process…