PT-2022-14266 · Ge · Ge Cimpicity

Published 2022-12-07 · Updated 2022-12-09 · CVE-2022-2002

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE CIMPICITY versions 2022 and prior

Description The issue arises when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, potentially allowing an attacker to execute arbitrary code.

Recommendations For GE CIMPICITY versions 2022 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Pointer Dereference

Weakness Enumeration

CWE-822

Related Identifiers

CVE-2022-2002

Affected Products

Ge Cimpicity

References · 4

• https://osv.dev/vulnerability/CVE-2022-2002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2002 · Security Note
• https://t.me/cvenotify/39396 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-326-04 · Note