CVE-2020-6992 Privilege escalation in GE Digital CIMPLICITY

What is CVE-2020-6992?

CVE-2020-6992 is a medium-severity vulnerability in GE Digital CIMPLICITY, published on 15 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product v10.0 and prior. If exploited, this vulnerability could allow an adversary to modify the system, leading to the arbitrary execution of code. This vulnerability is only exploitable if an attacker has access to an authenticated session. GE Digital CIMPLICITY v11.0, released January 2020, contains mitigation for this local privilege escalation vulnerability. GE Digital recommends all users upgrade to GE CIMPLICITY v11.0 or newer.

Weakness: CWE-269

Which versions are affected by CVE-2020-6992?

It affects 1 product.

Products include Ge Cimplicity.

How do I fix CVE-2020-6992?

No fix has been published for CVE-2020-6992 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-6992 being exploited?

There is no known exploitation of CVE-2020-6992 in the wild and no public exploit code.

Other vulnerabilities in GE Digital CIMPLICITY

• CVE-2018-15362 XML external entity in GE Proficy Cimplicity GDS Critical 9.1
• CVE-2023-4487 GE Digital CIMPLICITY Process Control High 7.8
• CVE-2022-2002 GE CIMPLICITY Untrusted Pointer Dereference High 7.8
• CVE-2022-2948 GE CIMPLICITY Heap-based Buffer Overflow High 7.8
• CVE-2022-2952 GE CIMPLICITY Access of Uninitialized Pointer High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xw2r-q7pv-2r5q.