CVE-2016-9360 Information disclosure in GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian

What is CVE-2016-9360?

CVE-2016-9360 is a medium-severity vulnerability in GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian, published on 13 Feb 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has access to an authenticated session.

Weakness: CWE-522

Which versions are affected by CVE-2016-9360?

It affects 3 products.

Products include Ge Cimplicity, Ge Historian, Ge Ifix.

How do I fix CVE-2016-9360?

No fix has been published for CVE-2016-9360 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-9360 being exploited?

There is no known exploitation of CVE-2016-9360 in the wild and no public exploit code.

Other vulnerabilities in GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian

• CVE-2018-15362 XML external entity in GE Proficy Cimplicity GDS Critical 9.1
• CVE-2023-4487 GE Digital CIMPLICITY Process Control High 7.8
• CVE-2022-2002 GE CIMPLICITY Untrusted Pointer Dereference High 7.8
• CVE-2022-2948 GE CIMPLICITY Heap-based Buffer Overflow High 7.8
• CVE-2022-2952 GE CIMPLICITY Access of Uninitialized Pointer High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2cq-36cr-qccv.