What is the CVSS score of CVE-2014-0750?

CVE-2014-0750 has a CVSS 2.0 base score of 7.5 (High). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 37.6%.

Is there a public PoC exploit available for CVE-2014-0750?

Yes, a public proof-of-concept exploit is available for CVE-2014-0750. Prioritise patching immediately. EPSS: 37.6%.

Intelligent Platforms Proficy Hmi Scada Cimplicity CVE-2014-0750

HIGH

Path Traversal (CWE-22)

2014-01-25 ics-cert@hq.dhs.gov

RCE Path Traversal Intelligent Platforms Proficy Hmi Scada Cimplicity Intelligent Platforms Proficy Process Systems With Cimplicity Intelligent Platforms Proficy Hmi 2Fscada Cimplicity Ge

7.5

CVSS 2.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-22 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Path canonicalization, traversal prevention MITRE ATT&CK 2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 7.5 (HIGH). Attack characteristics: network attack vector, low complexity. Public proof-of-concept exploit code is available. EPSS exploitation probability: 37.56%.
Exploit ScenarioDerived	A remote attacker could access files and directories outside the intended path by sending crafted requests to the affected application.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

No patch listed yet 37.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 37.6%.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622. Affected products include: Ge Intelligent Platforms Proficy Hmi\%2Fscada Cimplicity, Ge Intelligent Platforms Proficy Hmi\/Scada Cimplicity, Ge Intelligent Platforms Proficy Process Systems With Cimplicity. Version information: through 8.2.

Know when Intelligent Platforms Proficy Hmi Scada Cimplicity gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

DescriptionCVE.org

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.

Threat Intelligence Overview

Threat Score

4.1/10

Composite threat intelligence

EPSS Score

37.6%

Top 3% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (1)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 37.6%

Patch available No

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

High

Priority Score

111

Low Medium High Critical

KEV: 0

EPSS: +38

CVSS: +38

PoC: +20

Weaponized: +15

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\%2fscada_cimplicity:*:sim24:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:4.01:*:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:7.5:*:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.0:*:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.1:*:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_hmi\/scada_cimplicity:8.2:*:*:*:*:*:*:*

cpe:2.3:a:ge:intelligent_platforms_proficy_process_systems_with_cimplicity:-:*:*:*:*:*:*:*

More in Intelligent Platforms Proficy Hmi Scada Cimplicity

View all

CVE-2013-2785 CRITICAL Act Now

9.3 Jul 31

Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - C

CVE-2013-0653 MEDIUM This Month POC

4.3 Jan 27

Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy

CVE-2013-0654 CRITICAL Act Now

9.3 Jan 27

CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems wi

CVE-2013-2811 HIGH This Week

7.1 Nov 22

The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.2

CVE-2014-0751 MEDIUM This Month

6.8 Jan 25

The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into th

CVE-2017-12732 MEDIUM This Month

6.8 Oct 05

A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. Rated medium severity (CVSS

CVE-2014-2355 MEDIUM This Month

6.6 Jan 17

The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to

CVE-2013-2823 MEDIUM This Month

4.7 Nov 22

The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.2

CVE-2012-4689 MEDIUM This Month

4.3 Jan 17

Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Pr

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

References

Advisories & patches

ADVISORY http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 REF http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01 REF http://www.securityfocus.com/bid/65124 REF https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back