title: ICSA-22-053-01 GE Proficy CIMPLICITY-IPM
description: Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
problem types: CWE-269 Improper Privilege Management
affected:
{
product: Proficy CIMPLICITY
vendor: General Electric
versions:
lessThanOrEqual: 11.1, status: affected, version: all, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: GE Digital recommends users upgrade all instances of the affected software to GE Digital’s Proficy CIMPLICITY, released January 2022 (Upgrade) and follow the instructions in the Secure Deployment Guide to restrict which CIMPLICITY projects are allowed to run.
The upgrade contains what GE believes are mitigation measures to help ensure the vulnerability cannot be exploited.
Users are encouraged to contact a GE Digital representative for the latest versions of the update.
For users who choose to not implement the upgrade, GE Digital recommends applying the instructions in CIMPLICITY’s Secure Deployment Guide to ensure access to the CIMPLICITY machines and directories are properly controlled via access control limits.