PT-2014-3813 · Ge Intelligent Platforms · Proficy Process Systems+1

Publicado 2014-01-25 · Atualizado 2014-02-21 · CVE-2014-0750

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24 Proficy Process Systems with CIMPLICITY (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary code via a crafted HTTP request. This is related to a directory traversal vulnerability in the gefebt.exe component of the WebView CimWeb components.

Recommendations For GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24, update to version 8.2 SIM 24 or later to resolve the issue. For Proficy Process Systems with CIMPLICITY, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-0750

ZDI-14-015

Produtos afetados

Proficy Hmi/Scada - Cimplicity

Proficy Process Systems

Referências · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb · Exploit
• 🔥 https://exploit-db.com/exploits/31987 · Exploit
• https://cisa.gov/news-events/ics-advisories/icsa-14-023-01 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0750 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0750 · Nota de Segurança
• http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 · Nota
• https://zerodayinitiative.com/advisories/ZDI-14-015 · Nota de Segurança
• http://securityfocus.com/bid/65124 · Nota
• http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 · Aviso do Fabricante