GE Intelligent Platforms Proficy Cimplicity is prone to multiple Vulnerabilities

If the vulnerabilities are exploited, they could allow an unauthenticated remote attacker to cause the CIMPLICITY built-in Web server to crash or to run arbitrary commands on a server running the affected software, or could potentially allow an attacker to take control of the CIMPLICITY server.

Updates are available.

General Electric (GE) has addressed two vulnerabilities in GE Intelligent Platforms Proficy HMI/SCADA-CIMPLICITY: a directory transversal vulnerability and improper input validation vulnerability. GE has released two security advisories (GEIP12-13 and GEIP12-19) available on the GE Intelligent Platforms support Web site to inform customers about these vulnerabilities.

GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY

Send a maliciously crafted HTTP request to read a local file.

• http://ics-cert.us-cert.gov/advisories/ICSA-13-022-02
• http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15153
• http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15244

---

Updated on 2015-03-25