CVE-2023-4487

GE Digital CIMPLICITY Process Control

State: Published
Severity: 7.8 High
Published: Sep 5, 2023
Updated: Jan 16, 2025
Reserved: Aug 22, 2023

Description

GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-114 Process Control

Affected Products

Product	Versions
CIMPLICITYGE Digital	2023Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-02
https://digitalsupport.ge.com/s/article/GE-Digital-CIMPLICITY-Privilege-Escalation-Vulnerability

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.