CVE-2022-21798 ICSA-22-053-02 GE Proficy CIMPLICITY-Cleartext

What is CVE-2022-21798?

CVE-2022-21798 is a high-severity vulnerability in General Electric Proficy CIMPLICITY, published on 25 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.

Weakness: CWE-319

Which versions are affected by CVE-2022-21798?

It affects 1 product.

Products include Ge Cimplicity.

How do I fix CVE-2022-21798?

No fix has been published for CVE-2022-21798 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-21798 being exploited?

There is no known exploitation of CVE-2022-21798 in the wild and no public exploit code.

Other vulnerabilities in General Electric Proficy CIMPLICITY

• CVE-2018-15362 XML external entity in GE Proficy Cimplicity GDS Critical 9.1
• CVE-2023-4487 GE Digital CIMPLICITY Process Control High 7.8
• CVE-2022-2002 GE CIMPLICITY Untrusted Pointer Dereference High 7.8
• CVE-2022-2948 GE CIMPLICITY Heap-based Buffer Overflow High 7.8
• CVE-2022-2952 GE CIMPLICITY Access of Uninitialized Pointer High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xvrm-wwcv-vr6g.