Skip to content
CVE Tracker
Back

CVE-2022-2002

GE CIMPLICITY Untrusted Pointer Dereference

High7.8EPSS 0.31%
Published
Updated
Reserved
Assigned by
icscert

Description

GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.

Scores

CVSS scores of CVE-2022-2002, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1High7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.31% · top 76% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

Affected products

  • GE · CIMPLICITY

    • affected ≤ v2022

What to do

Solution: GE recommends users refer to the CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2  (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. For more information about this issue, see the GE Digital Product Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06  (login required). For further questions, users should contact GE https://digitalsupport.ge.com/communities/CC_Contact .

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .