CVE-2012-2516 An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and...
HighCVSS 9.3
EPSS 39.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ge intelligent platforms proficy batch execution | = 5.6 | No fix listed |
| ge intelligent platforms proficy historian | = 3.1 | No fix listed |
| ge intelligent platforms proficy historian | = 3.5 | No fix listed |
| ge intelligent platforms proficy historian | = 4.0 | No fix listed |
| ge intelligent platforms proficy historian | = 4.5 | No fix listed |
| ge intelligent platforms proficy hmiscada ifix | = 5.0 | No fix listed |
| ge intelligent platforms proficy hmiscada ifix | = 5.1 | No fix listed |
| ge intelligent platforms proficy pulse | = 1.0 | No fix listed |
| ge intelligent platforms si7 io driver | = 7.20 | No fix listed |
| ge intelligent platforms si7 io driver | = 7.42 | No fix listed |
References
- support.ge-ip.com vendor-advisory
- www.us-cert.gov us-government-resource