6.7med
CVE-2016-9360
An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.7
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 31%
Public exploits
0
none known
Summary
An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has access to an authenticated session.
Exploit prediction (EPSS)
0.37% probability of exploitation in the next 30 days, higher than 31% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- n/a GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian
Classification
- Weakness
- CWE-522 Insufficiently Protected Credentials
References
- securitytracker.com /id/1037809 · vdb-entry, x_refsource_SECTRACK, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-16-336-05A · x_refsource_MISC, x_transferred
- securityfocus.com /bid/95630 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-9360
- NVD: CVE-2016-9360
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.