CVE-2023-0598

GE Digital Proficy Code Injection

State: Published
Severity: 7.8 High
Published: Mar 16, 2023
Updated: Jan 16, 2025
Reserved: Jan 31, 2023

Description

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-94 Code Injection

Affected Products

Product	Versions
Proficy iFIXGE Digital	2022 Affected v6.1 Affected v6.5 Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03
https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.