88
CVEs
33
Critical
27
High
0
KEV
6
PoC
54
Unpatched C/H
8.0%
Patch Rate
3.8%
Avg EPSS
Severity Breakdown
CRITICAL
33
HIGH
27
MEDIUM
28
LOW
0
Monthly CVE Trend
Affected Products (30)
Cimplicity
12
Intelligent Platforms Proficy Hmi Scada Cimplicity
10
Intelligent Platforms Proficy Real Time Information Portal
6
Intelligent Platforms Proficy Process Systems With Cimplicity
6
Ge Communicator
5
Inet Ii 900 Firmware
5
Sd9 Firmware
5
Inet 900 Firmware
5
Sd4 Firmware
5
Td220Max Firmware
5
Mds Pulsenet
5
Sd2 Firmware
5
Sd1 Firmware
5
Td220X Firmware
5
Intelligent Platforms Proficy Hmi Scada Ifix
4
Thingworx Kepware Edge
4
Kepserver Enterprise
4
Thingworx Industrial Connectivity
4
Intelligent Platforms Proficy Process Systems
3
Intelligent Platforms Proficy Historian
3
Multilink Ml1200 Firmware
3
Ifix
3
Reason Dr60 Firmware
3
Multilink Ml1600 Firmware
3
Multilink Ml800 Firmware
3
Mu320E Firmware
3
S2020 Firmware
3
Multilink Ml810 Firmware
3
Multilink Ml3100 Firmware
3
Multilink Ml3000 Firmware
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2012-2516 | An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 69.4%. | CRITICAL | 9.3 | 69.4% | 151 |
PoC
No patch
|
| CVE-2012-2515 | Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.8%. | CRITICAL | 9.3 | 64.8% | 146 |
PoC
No patch
|
| CVE-2014-0750 | Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 37.6%. | HIGH | 7.5 | 37.6% | 110 |
PoC
No patch
|
| CVE-2016-0861 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 10.1%. | HIGH | 8.8 | 10.1% | 74 |
PoC
No patch
|
| CVE-2016-0862 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 19.2%. | MEDIUM | 6.5 | 19.2% | 72 |
PoC
No patch
|
| CVE-2012-0229 | The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 5.5% | 56 |
No patch
|
| CVE-2012-3010 | rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 3.1% | 53 |
No patch
|
| CVE-2012-3021 | rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 3.1% | 53 |
No patch
|
| CVE-2012-3026 | rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 3.1% | 53 |
No patch
|
| CVE-2012-0230 | PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 2.0% | 52 |
No patch
|
| CVE-2012-0231 | PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 1.8% | 52 |
No patch
|
| CVE-2013-2785 | Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available. | CRITICAL | 9.3 | 5.3% | 52 |
No patch
|
| CVE-2015-6459 | Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote attackers to read or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 1.6% | 52 |
No patch
|
| CVE-2014-5419 | GE Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware 4.2.1 and earlier and Multilink ML810, ML3000, and ML3100 switches with firmware 5.2.0 and earlier use the same RSA private key. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | CRITICAL | 10.0 | 1.4% | 51 |
No patch
|
| CVE-2013-0653 | Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available. | MEDIUM | 4.3 | 9.5% | 51 |
PoC
No patch
|