PT-2022-4239 · Ge Digital · Proficy Machine Edition

Sharon Brizinov · Published 2022-08-16 · Updated 2023-06-28 · CVE-2022-2788

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Proficy Machine Edition versions 9.80 and prior

Description The issue is related to a Path Traversal vulnerability, also known as a ZipSlip attack, which allows attackers to implant a malicious .BLZ file on the PLC through an upload procedure. This can lead to the execution of malicious code when the file is transferred from the engineering station to Windows. The vulnerability is due to incorrect restriction of a pathname to a directory with limited access, enabling a remote attacker to execute arbitrary code using a specially crafted .BLZ file.

Recommendations For Proficy Machine Edition versions 9.80 and prior, consider disabling the upload procedure that enables attackers to implant malicious .BLZ files until a patch is available. Restrict access to the engineering station to minimize the risk of exploitation. Avoid using the upload feature for .BLZ files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

BDU:2022-05088

CVE-2022-2788

Affected Products

Proficy Machine Edition

References · 7

• https://bdu.fstec.ru/vul/2022-05088 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2788 · Security Note
• https://t.me/cibsecurity/48461 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-228-06 · Note
• https://t.me/true_secator/3323 · Telegram Post
• https://t.me/cvenotify/35001 · Telegram Post