CVE-2023-0598 (GCVE-0-2023-0598)

Vulnerability from cvelistv5 – Published: 2023-03-16 19:13 – Updated: 2025-01-16 21:41
VLAI?
Summary
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
GE Digital Proficy iFIX Affected: 2022
Affected: v6.1
Affected: v6.5
Create a notification for this product.
Credits
Michael Heinzl reported this vulnerability to CISA.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:50.230Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T20:31:26.846274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:41:46.328Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Proficy iFIX",
          "vendor": "GE Digital ",
          "versions": [
            {
              "status": "affected",
              "version": "2022 "
            },
            {
              "status": "affected",
              "version": "v6.1 "
            },
            {
              "status": "affected",
              "version": " v6.5 "
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Michael Heinzl reported this vulnerability to CISA. "
        }
      ],
      "datePublic": "2023-03-14T19:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eGE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nGE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T19:13:52.427Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03"
        },
        {
          "url": "https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cp\u003eGE Digital recommends that users upgrade to Proficy iFIX 2023. GE Digital recommends that any users choosing not to upgrade at this time apply the Simulation Drivers (SIMs) provided below to their earlier GE Digital Proficy iFIX versions (login required): \u003c/p\u003e\u003cul\u003e\u003cli\u003eiFIX 2023 - select \u201cDownload Software Updates\u201d: \u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/s/article/iFIX2022-WebSecurity-001?language=en_US\"\u003eiFIX 2022 SIM\u003c/a\u003e\u0026nbsp; \u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/s/article/iFIX61-WebSecurity-001?language=en_US\"\u003eiFIX v6.1 SIM\u003c/a\u003e\u0026nbsp; \u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/s/article/iFIX65-WebSecurity-001?language=en_US\"\u003eiFIX v6.5 SIM\u003c/a\u003e\u0026nbsp;\u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nGE Digital recommends that users upgrade to Proficy iFIX 2023. GE Digital recommends that any users choosing not to upgrade at this time apply the Simulation Drivers (SIMs) provided below to their earlier GE Digital Proficy iFIX versions (login required): \n\n  *  iFIX 2023 - select \u201cDownload Software Updates\u201d:   *   iFIX 2022 SIM https://digitalsupport.ge.com/s/article/iFIX2022-WebSecurity-001 \u00a0 \n  *   iFIX v6.1 SIM https://digitalsupport.ge.com/s/article/iFIX61-WebSecurity-001 \u00a0 \n  *   iFIX v6.5 SIM https://digitalsupport.ge.com/s/article/iFIX65-WebSecurity-001 \u00a0\n\n\n\n\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "GE Digital Proficy Code Injection",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAlso, users are strongly advised to refer to the Secure Deployment Guide (SDG) instructions on how to set-up and configure Access Control List (ACLs). The complete SDG can be found \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US\"\u003ehere\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u0026nbsp;\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nAlso, users are strongly advised to refer to the Secure Deployment Guide (SDG) instructions on how to set-up and configure Access Control List (ACLs). The complete SDG can be found  here https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide . \u00a0\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-0598",
    "datePublished": "2023-03-16T19:13:52.427Z",
    "dateReserved": "2023-01-31T15:52:11.560Z",
    "dateUpdated": "2025-01-16T21:41:46.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ge:ifix:6.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B27A2AD-28E2-4408-83AC-5E4A822E36B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ge:ifix:6.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EA175762-BC1D-4E0F-8BCC-7B3F746D30A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ge:ifix:2022:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBACBA0A-91D6-466D-B83B-4C7173ECB4B2\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"\\nGE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. \\n\\n\"}]",
      "id": "CVE-2023-0598",
      "lastModified": "2024-11-21T07:37:27.820",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2023-03-16T20:15:11.327",
      "references": "[{\"url\": \"https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}]",
      "sourceIdentifier": "ics-cert@hq.dhs.gov",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-94\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-0598\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2023-03-16T20:15:11.327\",\"lastModified\":\"2024-11-21T07:37:27.820\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"\\nGE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software. \\n\\n\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ge:ifix:6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B27A2AD-28E2-4408-83AC-5E4A822E36B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ge:ifix:6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA175762-BC1D-4E0F-8BCC-7B3F746D30A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ge:ifix:2022:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBACBA0A-91D6-466D-B83B-4C7173ECB4B2\"}]}]}],\"references\":[{\"url\":\"https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=en_US\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.