GE CIMPLICITY Access of Uninitialized Pointer

Description

GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

• CWE-824 Access of Uninitialized Pointer (opens in a new tab)All about CWE-824 and its CVEs

Affected products

• GE · CIMPLICITY

  • affected ≤ v2022

What to do

Solution: GE recommends users refer to the CIMPLICITY Secure Deployment Guide https://digitalsupport.ge.com/communities/en_US/Documentation/CIMPLICITY-Secure-Deployment-Guide2  (login required) for mitigations to the reported vulnerabilities. Specific sections to reference include Section 3.5 Projects and Section 4.2 CimView. For more information about this issue, see the GE Digital Product Security Advisory https://digitalsupport.ge.com/communities/en_US/Article/GE-Digital-Security-Advisory-GED-22-06  (login required). For further questions, users should contact GE https://digitalsupport.ge.com/communities/CC_Contact .

References (1)

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-2952](https://trackcve.app/badge/CVE-2022-2952.svg)](https://trackcve.app/cve/CVE-2022-2952)

Record last updated 16 Apr 2025, 17:41 UTC.