Sign-up

ID

VAR-202211-1446


CVE

CVE-2022-2948


TITLE

General Electric Company  of  CIMPLICITY  Heap-based buffer overflow vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-022589

DESCRIPTION

GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. General Electric Company of CIMPLICITY Exists in a heap-based buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. GE CIMPLICITY HMI/SCADA Software is an automated industrial platform of General Electric (GE). Provides true client-server visualization and control from a single machine to plant locations around the world, helping to manage operations and improve decision making. An attacker could exploit the vulnerability to potentially affect the confidentiality, availability, or integrity of the system. There are currently no vulnerability details. GE CIMPLICITY

Trust: 2.25

sources: NVD: CVE-2022-2948 // JVNDB: JVNDB-2022-022589 // CNVD: CNVD-2022-85525 // VULMON: CVE-2022-2948

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-85525

AFFECTED PRODUCTS

vendor:gemodel:cimplicityscope:lteversion:2022

Trust: 1.0

vendor:general electricmodel:cimplicityscope:lteversion:2022 and earlier

Trust: 0.8

vendor:general electricmodel:cimplicityscope:eqversion: -

Trust: 0.8

vendor:general electricmodel:cimplicityscope: - version: -

Trust: 0.8

vendor:gemodel:cimplicity hmi/scada softwarescope:lteversion:<=2022

Trust: 0.6

sources: CNVD: CNVD-2022-85525 // JVNDB: JVNDB-2022-022589 // NVD: CVE-2022-2948

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-2948
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2022-2948
value: HIGH

Trust: 1.0

NVD: CVE-2022-2948
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-85525
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202211-3422
value: HIGH

Trust: 0.6

CNVD: CNVD-2022-85525
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-2948
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-2948
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-85525 // JVNDB: JVNDB-2022-022589 // CNNVD: CNNVD-202211-3422 // NVD: CVE-2022-2948 // NVD: CVE-2022-2948

PROBLEMTYPE DATA

problemtype:CWE-122

Trust: 1.0

problemtype:Heap-based buffer overflow (CWE-122) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022589 // NVD: CVE-2022-2948

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202211-3422

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202211-3422

PATCH

title:Patch for GE CIMPLICITY HMI/SCADA Software Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/364096

Trust: 0.6

title:GE CIMPLICITY HMI/SCADA Software Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=216960

Trust: 0.6

sources: CNVD: CNVD-2022-85525 // CNNVD: CNNVD-202211-3422

EXTERNAL IDS

db:NVDid:CVE-2022-2948

Trust: 3.9

db:ICS CERTid:ICSA-22-326-04

Trust: 2.5

db:AUSCERTid:ESB-2022.6117

Trust: 1.2

db:JVNid:JVNVU95378145

Trust: 0.8

db:JVNDBid:JVNDB-2022-022589

Trust: 0.8

db:CNVDid:CNVD-2022-85525

Trust: 0.6

db:CNNVDid:CNNVD-202211-3422

Trust: 0.6

db:VULMONid:CVE-2022-2948

Trust: 0.1

sources: CNVD: CNVD-2022-85525 // VULMON: CVE-2022-2948 // JVNDB: JVNDB-2022-022589 // CNNVD: CNNVD-202211-3422 // NVD: CVE-2022-2948

REFERENCES

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04

Trust: 2.5

url:https://www.auscert.org.au/bulletins/esb-2022.6117

Trust: 1.2

url:https://jvn.jp/vu/jvnvu95378145/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-2948

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-2948/

Trust: 0.6

sources: CNVD: CNVD-2022-85525 // VULMON: CVE-2022-2948 // JVNDB: JVNDB-2022-022589 // CNNVD: CNNVD-202211-3422 // NVD: CVE-2022-2948

SOURCES

db:CNVDid:CNVD-2022-85525
db:VULMONid:CVE-2022-2948
db:JVNDBid:JVNDB-2022-022589
db:CNNVDid:CNNVD-202211-3422
db:NVDid:CVE-2022-2948

LAST UPDATE DATE

2024-08-14T13:42:39.248000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-85525date:2022-12-07T00:00:00
db:JVNDBid:JVNDB-2022-022589date:2023-11-17T08:22:00
db:CNNVDid:CNNVD-202211-3422date:2022-12-12T00:00:00
db:NVDid:CVE-2022-2948date:2023-11-07T03:47:07.493

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-85525date:2022-12-07T00:00:00
db:JVNDBid:JVNDB-2022-022589date:2023-11-17T00:00:00
db:CNNVDid:CNNVD-202211-3422date:2022-11-23T00:00:00
db:NVDid:CVE-2022-2948date:2022-12-07T23:15:09.930