Path Traversal in Ge Intelligent Platforms Proficy Hmi\%2fscada Cimplicity
CVE-2014-0750
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.698 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.702 · newest: 0.698 · change: -0.004
Affected products
- Ge Intelligent Platforms Proficy Hmi\%2fscada Cimplicity
- Ge Intelligent Platforms Proficy Hmi\/scada Cimplicity — versions 4.01, 7.5, 8.0
- Ge Intelligent Platforms Proficy Process Systems With Cimplicity
- Ge Proficy Hmi/scada - Cimplicity — versions 4.01
- Ge Proficy Process Systems With Cimplicity — versions all versions
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.cisa.gov/news-events/ics-advisories/icsa-14-023-01
- support.ge-ip.com/support/index (Vendor Advisory)
- www.securityfocus.com/bid/65124 (vdb-entry)
- af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)
Frequently asked questions
- What is CVE-2014-0750?
- CVE-2014-0750 is a vulnerability in Ge Intelligent Platforms Proficy Hmi\%2fscada Cimplicity, classified under Path Traversal. Published 2014-01-25.
- Is CVE-2014-0750 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.