CVE-2022-23921: ICSA-22-053-01 GE Proficy CIMPLICITY-IPM

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-25 · updated 2026-06-17
Weakness: CWE-269

Description

Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.

Affected products

GE Proficy Cimplicitiy: through 11.1

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-01
https://www.cisa.gov/uscert/ics/advisories/icsa-22-053-01

Get alerted when CVE-2022-23921 or the next vulnerability affects your stack