Paper/Archive/CVE-2022-46732

CVE-2022-46732

GE Digital Proficy Historian — CVE-2022-46732

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

41

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 58.0.580 × 2011.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.

Affected

ProductAffectedFixed inSource

Proficy Historian7.0–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-23-017-01 refdigitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01