{"id":"CVE-2014-0751","aliases":["EUVD-2014-0782","GHSA-5q8q-px6g-7r9f"],"status":"published","title":"GE Proficy HMI/SCADA Path Traversal","description":"The CIMPLICITY Web-based access component, CimWebServer, does not check \nthe location of shell files being loaded into the system. By modifying \nthe source location, an attacker could send shell code to the \nCimWebServer which would deploy the nefarious files as part of any SCADA\n project. This could allow the attacker to execute arbitrary code.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03075,"percentile":0.87748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2014-01-25T22:00:00Z","modified":"2026-06-17T00:03:34Z","products":[{"vendor":"ge","product":"intelligent_platforms_proficy_hmi\\%2fscada_cimplicity"},{"vendor":"ge","product":"intelligent_platforms_proficy_hmi\\/scada_cimplicity"},{"vendor":"ge","product":"intelligent_platforms_proficy_process_systems_with_cimplicity"},{"vendor":"ge","product":"proficy hmi/scada - cimplicity"},{"vendor":"ge","product":"proficy process systems with cimplicity"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01"},{"url":"http://support.ge-ip.com/support/index?page=kbchannel\u0026id=KB15939","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/65124","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://support.ge-ip.com/support/index?page=kbchannel\u0026id=KB15940","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/65117","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0751"},{"url":"https://github.com/advisories/GHSA-5q8q-px6g-7r9f"}],"sources":{"cve":[{"id":"CVE-2014-0751","title":"GE Proficy HMI/SCADA Path Traversal","description":"The CIMPLICITY Web-based access component, CimWebServer, does not check \nthe location of shell files being loaded into the system. By modifying \nthe source location, an attacker could send shell code to the \nCimWebServer which would deploy the nefarious files as part of any SCADA\n project. This could allow the attacker to execute arbitrary code.","status":"published","published":"2014-01-25T22:00:00Z","modified":"2025-08-22T22:51:23.718Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0782","description":"The CIMPLICITY Web-based access component, CimWebServer, does not check \nthe location of shell files being loaded into the system. By modifying \nthe source location, an attacker could send shell code to the \nCimWebServer which would deploy the nefarious files as part of any SCADA\n project. This could allow the attacker to execute arbitrary code.","status":"published","published":"2014-01-25T22:00:00Z","modified":"2025-08-22T22:51:23Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T20:31:54.001843Z"}],"ghsa":[{"id":"GHSA-5q8q-px6g-7r9f","title":"Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE...","description":"Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623.","status":"published","published":"2022-05-17T04:52:25Z","modified":"2025-08-23T00:32:15Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:03:23.253097Z"}],"nvd":[{"id":"CVE-2014-0751","description":"The CIMPLICITY Web-based access component, CimWebServer, does not check \nthe location of shell files being loaded into the system. By modifying \nthe source location, an attacker could send shell code to the \nCimWebServer which would deploy the nefarious files as part of any SCADA\n project. This could allow the attacker to execute arbitrary code.","status":"published","published":"2014-01-25T22:55:04.583Z","modified":"2026-06-17T00:03:34.383Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:02:53.330367Z"}]}}