PT-2020-5890 · Ge Digital · Ge Digital Cimplicity Hmi/Scada

Published 2020-04-07 · Updated 2020-04-22 · CVE-2020-6992

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GE Digital CIMPLICITY HMI/SCADA versions prior to 11.0

Description: A local privilege escalation issue has been identified, which could allow an adversary to modify the system, leading to the arbitrary execution of code if an attacker has access to an authenticated session. This issue is related to insufficient access control in the Proficy HMI/SCADA CIMPLICITY application, which could enable an attacker to execute arbitrary code or elevate their privileges.

Recommendations: For GE Digital CIMPLICITY HMI/SCADA versions prior to 11.0, upgrade to GE CIMPLICITY v11.0 or newer to mitigate this issue.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-01982

CVE-2020-6992

Affected Products

Ge Digital Cimplicity Hmi/Scada

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-6992 · Security Note
• https://bdu.fstec.ru/vul/2021-01982 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6992 · Vendor Advisory
• https://ge.com/content/dam/cyber_security/global/en_US/pdfs/2021-03-08%20ICS%20Advisory%20(ICSA-20-098-02)%20for%20CIMPLICITY.pdf · Note
• https://us-cert.gov/ics/advisories/icsa-20-098-02 · Note