title: ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext
description: The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
problem types: CWE-319 Cleartext Transmission of Sensitive Information
affected:
{
product: Proficy CIMPLICITY
vendor: General Electric
versions:
status: affected, version: all
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Users are advised to refer to the Secure Deployment Guide on how to configure communication encryption.
Users are encouraged to review the CIMPLICITY Windows Hardening Guide and Recommendations for further IPSEC configuration guidance found in the section titled “Appendix A IPSEC Configuration.”
Users are encouraged to contact a GE representative to obtain the latest versions of CIMPLICITY.