CVE-2022-2788: Emerson Electric's Proficy

High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.

Affected products

• Emerson Electric's Proficy: up to and including 9.80

Published 2022-08-19. Last modified 2026-06-17.