HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2023-0598

CVSS 7.8v3.1pub. 2023-03-16upd. 2024-11-21

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Ge Ifix

    APP
    Ge
    20226.16.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2019-18243MEDIUM5.5ten sam produkt

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configura...

CVE-2019-18255MEDIUM5.5ten sam produkt

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configura...

CVE-2018-17925MEDIUM4.8ten sam produkt

Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identifi...

CVE-2016-9360MEDIUM6.7ten sam produkt

An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions,...

CVE-2023-5908CRITICAL9.1PL ✓ten sam vendor

Buffer overflow w KEPServerEX umożliwiający crash lub wyciek danych