PT-2023-7457 · Ge Digital · Ge Digital Proficy Ifix

Michael Heinzl · Published 2023-03-14 · Updated 2023-03-23 · CVE-2023-0598

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GE Digital Proficy iFIX versions 6.1 through 6.5 GE Digital Proficy iFIX 2022

Description The issue is related to incorrect code generation management in the GE Proficy HMI/SCADA iFIX software, which may allow an attacker to gain full control of the HMI software by inserting malicious configuration files in the expected web server execution path. This can be achieved through code injection, potentially enabling an attacker to exploit the software remotely.

Recommendations For GE Digital Proficy iFIX versions 6.1 through 6.5, consider disabling the web server execution path until a patch is available to prevent malicious configuration files from being inserted. For GE Digital Proficy iFIX 2022, restrict access to the configuration files to minimize the risk of exploitation. As a temporary workaround, avoid using the expected web server execution path in the affected software until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2023-08499

CVE-2023-0598

Affected Products

Ge Digital Proficy Ifix

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-0598 · Security Note
• https://bdu.fstec.ru/vul/2023-08499 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0598 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-073-03 · Note
• https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US · Note
• https://t.me/cibsecurity/60202 · Telegram Post