Yesterday, GE Digital published 2 advisories of vulnerabilities in GE’s SCADA/HMI product - Proficy CIMPLICITY that were discovered by OTORIO’s research team.
The two vulnerabilities are -
GE Digital is a leading provider of industrial software solutions and IIoT services. As such, their systems can be found in almost every industry. The GE CIMPLICITY is a well known HMI/SCADA system with a well-established track record. Where installed, CIMPLICITY is typically the key component that controls and monitors the operations in the manufacturing environment.
Given CIMPLICITY’s central role in OT environments, the two vulnerabilities introduce a huge disruptive impact potential on this operational server. We can assume that if and when attackers establish a foothold in the network, CIMPLICITY will be on top of their list.
Interestingly, the two vulnerabilities announced by GE are totally “mitigatable“. If the server’s installation was done correctly and with security in mind, there is a good chance that they’re not exploitable (unfortunately, all too often this is not the case).
The OTORIO Research team addressed the issues in the past. If we look at CVE-2022-21798 for example, the default configuration of the affected CIMPLICITY servers is vulnerable and exposes sensitive information to the network. However, If configured correctly with the existing security features of the system, the risk is immediately mitigated. Our recommendations, along with an open-source hardening tool we designed can be found below or by using this link: https://github.com/otoriocyber/CIMPLICITY-Hardening-Tool
A recognized global leader, GE Digital takes the security of their products seriously and applies time and resources to ensure its customers remain safe. We were truly impressed by the incredible engagement and collaboration of the GE team throughout the process. We also want to thank GE for endorsing OTORIO’s hardening tool in the Advisory itself. It is not trivial to get this kind of support from such a market leader.
For any question or suggestion regarding the vulnerabilities or security measures, feel free to contact us at -