Ge Ifix vulnerabilities

5 CVEs affecting Ge Ifix, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0598, published 2023-03-16.

More from Ge.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-0598, published 2023-03-16. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in…
• CVE-2016-9360, published 2017-02-13. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian…
• CVE-2018-17925, published 2018-10-10. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft.…
• CVE-2019-18243, published 2021-02-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
• CVE-2019-18255, published 2021-02-18. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.