PT-2022-19675 · Ge · Ge Cimpicity

Published 2022-12-07 · Updated 2022-12-09 · CVE-2022-2952

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE CIMPICITY versions 2022 and prior

Description The issue arises when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, potentially allowing an attacker to execute arbitrary code.

Recommendations For GE CIMPICITY versions 2022 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

CVE-2022-2952

Affected Products

Ge Cimpicity

References · 4

• https://osv.dev/vulnerability/CVE-2022-2952 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2952 · Security Note
• https://t.me/cvenotify/39394 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-326-04 · Note