CVE-2016-5787

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-15 · updated 2026-06-17
Weakness: CWE-668

Description

General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors.

Affected products

GE CIMPLICITY: before 8.2; 8.2-sim1, 8.2-sim10, 8.2-sim11, 8.2-sim12, 8.2-sim13, 8.2-sim14 (+20) — fixed in 8.2

How to fix

Upgrade to a fixed version: GE CIMPLICITY 8.2. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/91727
https://ge-ip.force.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-16-01
https://ics-cert.us-cert.gov/advisories/ICSA-16-194-02
http://www.securityfocus.com/bid/91727
https://ge-ip.force.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-16-01
https://ics-cert.us-cert.gov/advisories/ICSA-16-194-02

Get alerted when CVE-2016-5787 or the next vulnerability affects your stack