TI-2023-04140 Aliases CVE-2023-4487 GHSA-v7vw-fpcc-2x25

GE Digital CIMPLICITY Process Control

LOW 35CWE-114Published 2023-09-05 · Updated 2025-01-16

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00204 10th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GE	CIMPLICITY	2023	—	No fix listed	CNA

CIMPLICITY VendorGE Affected 2023 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ge:cimplicity:2023:-::::::	2023	Vulnerable	GE

cpe:2.3:a:ge:cimplicity:2023:-:*:*:*:*:*:* Versions 2023 Vulnerable ·GE

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-4487
2026-10-03 Alias added: GHSA-v7vw-fpcc-2x25

References

Advisory 1

https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-02

Other 1

https://digitalsupport.ge.com/s/article/GE-Digital-CIMPLICITY-Privilege-Escalation-Vulnerability

TI-2022-06170 ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext CVSS 3.1CRITICAL 9.8
TI-2018-10924 XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 CVSS 3.0CRITICAL 9.1
TI-2023-03234 GE Digital CIMPLICITY Heap-based Buffer Overflow CVSS 3.1CRITICAL 9.8
TI-2022-02853 GE CIMPLICITY Out-of-bounds Write CVSS 3.1HIGH 7.8
TI-2022-02845 GE CIMPLICITY Access of Uninitialized Pointer CVSS 3.1HIGH 7.8
TI-2022-02729 GE CIMPLICITY Access of Uninitialized Pointer CVSS 3.1HIGH 7.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences