CVE-2023-0598

Summary

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.

Affected Software

Weaknesses

• CWE-94: CWE-94 Code Injection

Workarounds

Also, users are strongly advised to refer to the Secure Deployment Guide (SDG) instructions on how to set-up and configure Access Control List (ACLs). The complete SDG can be found here https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide .  

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03
• https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03
• https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US

• ←Previous
• Next→