9.3
CVE-2012-2516
- EPSS 69.41%
- Published 05.07.2012 03:23:18
- Last modified 11.04.2025 00:51:21
- Source ics-cert@hq.dhs.gov
- Teams watchlist Login
- Open Login
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Data is provided by the National Vulnerability Database (NVD)
Ge ≫ Intelligent Platforms Proficy Batch Execution Version5.6
Ge ≫ Intelligent Platforms Proficy Historian Version3.1
Ge ≫ Intelligent Platforms Proficy Historian Version3.5
Ge ≫ Intelligent Platforms Proficy Historian Version4.0
Ge ≫ Intelligent Platforms Proficy Historian Version4.5
Ge ≫ Intelligent Platforms Proficy Pulse Version1.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 69.41% | 0.985 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.