PT-2022-4364 · Ge Digital · Proficy Machine Edition

Sharon Brizinov · Published 2022-08-16 · Updated 2022-11-26 · CVE-2022-2791

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Proficy Machine Edition versions 9.00 and prior

Description The issue is related to an unrestricted upload of files with dangerous types. This allows an attacker to upload and execute malicious files in the target system. The vulnerability is exploited by uploading any file written into the PLC logic folder to the connected PLC.

Recommendations For Proficy Machine Edition versions 9.00 and prior, consider restricting access to the PLC logic folder to prevent unauthorized file uploads until a patch is available. As a temporary workaround, avoid writing files into the PLC logic folder that could be potentially executed by the connected PLC. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2022-05224

CVE-2022-2791

Affected Products

Proficy Machine Edition

References · 7

• https://osv.dev/vulnerability/CVE-2022-2791 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05224 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2791 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-228-06 · Note
• https://t.me/true_secator/3323 · Telegram Post
• https://t.me/cvenotify/38513 · Telegram Post
• https://t.me/cibsecurity/53372 · Telegram Post