Vulnerability Description
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ge | Ifix | 6.1 |
Related Weaknesses (CWE)
References
- https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=enPermissions Required
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03Third Party AdvisoryUS Government Resource
- https://digitalsupport.ge.com/s/article/iFIX-Secure-Deployment-Guide?language=enPermissions Required
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-03Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2023-0598?
CVE-2023-0598 is a vulnerability with a CVSS score of 7.8 (HIGH). GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in t...
How severe is CVE-2023-0598?
CVE-2023-0598 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-0598?
Check the references section above for vendor advisories and patch information. Affected products include: Ge Ifix.