Medium ICSA-22-228-06 6 CVEs

Emerson Proficy Machine Edition

Published Aug 16, 2022 · Updated Aug 16, 2022

Vendor: Emerson Product: Proficy Machine Edition

Summary

Successful exploitation of these vulnerabilities could allow for remote hidden code execution on the connected programmable logic controller (PLC) and for malicious files to be uploaded from the PLC to connected workstations.

Vulnerabilities 6

Medium 6.6

CVE-2022-2792

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and…

Emerson Electric Proficy Machine Edition

Aug 19, 2022
Medium 5.9

CVE-2022-2790

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cry…

Emerson Electric Proficy Machine Edition

Aug 19, 2022
Medium 5.9

CVE-2022-2791

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File …

Emerson Electric Proficy Machine Edition

Nov 22, 2022
Medium 5.9

CVE-2022-2793

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrit…

Emerson Electric Proficy Machine Edition

Aug 19, 2022
Medium 4.7

CVE-2022-2789

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of…

Emerson Electric Proficy Machine Edition

Aug 19, 2022
Low 3.9

CVE-2022-2788

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename…

Emerson Electric Proficy Machine Edition

Aug 19, 2022

Revision history

2022-08-16 #1
Publication Date

References

ICS Advisory ICSA-22-228-06 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-228-06
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf