Emerson Electric's Proficy vulnerabilities

5 CVEs affecting Emerson Electric's Proficy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-2793, published 2022-08-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-2792, published 2022-08-19. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.
CVE-2022-2788, published 2022-08-19. High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days. Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables…
CVE-2022-2793, published 2022-08-19. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after…
CVE-2022-2790, published 2022-08-19. Medium severity, CVSS 5.9. EPSS: 0.1% chance of exploitation in the next 30 days. Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files)…
CVE-2022-2789, published 2022-08-19. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled…