CVE-2014-2355
GE Proficy HMI/SCADA CIMPLICITY CimView
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 2.0 | Medium6.6 | AV:L/AC:M/Au:S/C:C/I:C/A:C |
| NVDNVD · Modified | 2.0 | Medium6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
- EPSS (exploitation in 30 days)
- 0.65% · top 49% of all CVEs (4 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.6.
Weakness
Affected products
GE · Proficy HMI/SCADA–CIMPLICITY
- affected ≤ 8.2
What to do
Solution: GE recommends that asset owners apply product updates to Proficy HMI/SCADA–CIMPLICITY Versions 8.1 and 8.2. The following product updates address the memory access violation vulnerability: Proficy HMI/SCADA – CIMPLICITY 8.1 SIM 29 (DN4219) available at: http://support.ge-ip.com/support/index?page=dwchannel&id=DN4219 Proficy HMI/SCADA–CIMPLICITY 8.2 SIM 26 (DN4197) available at: http://support.ge-ip.com/support/index?page=dwchannel&id=DN4197
Workaround: In cases where upgrading is not feasible, GE advises asset owners using CIMPLICITY versions prior to 8.1 to consider using the following recommendations that may mitigate or eliminate the impact of the vulnerability: * Take steps to properly secure and protect stored CIMPLICITY screen files (.CIM). * Avoid using .CIM files received from unknown sources. * Avoid sending unprotected .CIM files over unencrypted networks or public Internet. * Consider using a strong hashing algorithm to validate integrity of created .CIM files and ensure they have not been tampered with over time.
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2014-2355)Record last updated .