Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent…
Priority MEDIUM 47CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.
Why it matters now
EPSS 0.03769 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | GE |
| cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | GE |
| cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.2:*:*:*:*:*:*:* | 8.2 | Vulnerable | GE |
| cpe:2.3:a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | GE |
- cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·GE
- cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·GE
- cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·GE
- cpe:2.3:a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GE
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-2785
- 2026-10-03 Alias added: GHSA-rrxc-8qxg-r958
References
More GE Intelligent Platforms Proficy Hmi/scada Cimplicity vulnerabilities
- TI-2014-00699 GE Proficy HMI/SCADA Path Traversal CVSS 2.0HIGH 7.5
- TI-2013-00547 CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0… CVSS 2.0HIGH 9.3
- TI-2014-00700 GE Proficy HMI/SCADA Path Traversal CVSS 2.0HIGH 7.5
- TI-2013-00546 Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE… CVSS 2.0MEDIUM 4.3
- TI-2013-02456 The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms… CVSS 2.0HIGH 7.1
- TI-2017-09437 Stack-based buffer overflow in GE CIMPLICITY CVSS 3.0MEDIUM 6.8
Sources
- CVE-2013-2785 · CVE Program
- CVE-2013-2785 · NVD
- FIRST EPSS
- GHSA-rrxc-8qxg-r958 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences