Read the docs
TI-2017-09437 Aliases CVE-2017-12732GHSA-cm9j-xv24-c3gf

Stack-based buffer overflow in GE CIMPLICITY

Priority LOW 31CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified, allowing a buffer overwrite that could lead to an arbitrary remote code execution.

Why it matters now

EPSS 0.0075 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—GE CIMPLICITYGE CIMPLICITY—No fix listedCNA
  • GE CIMPLICITY Vendor— Affected GE CIMPLICITY Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:*:*:*:*:*:*:*:*up to 9.0VulnerableGE
  • cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:*:*:*:*:*:*:*:* Versions up to 9.0 Vulnerable ·GE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12732
  2. 2026-10-03 Alias added: GHSA-cm9j-xv24-c3gf

References

Advisory 1

  • TI-2014-00699 GE Proficy HMI/SCADA Path Traversal CVSS 2.0HIGH 7.5
  • TI-2013-02433 Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent… CVSS 2.0HIGH 9.3
  • TI-2013-00547 CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0… CVSS 2.0HIGH 9.3
  • TI-2014-00700 GE Proficy HMI/SCADA Path Traversal CVSS 2.0HIGH 7.5
  • TI-2013-00546 Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE… CVSS 2.0MEDIUM 4.3
  • TI-2013-02456 The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms… CVSS 2.0HIGH 7.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences