CVE-2017-12732

medium

Published 2017-10-05 · Modified 2026-05-13

CVSS v3

6.8

CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS v2

4.9

VIR risk

6.8

Description

A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified, allowing a buffer overwrite that could lead to an arbitrary remote code execution.

Predictions

Exploit likelihood

67%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

Application impact

Vendor	Product	Versions	Fixed
ge	intelligent_platforms_proficy_hmi\/scada_cimplicity	`{"endIncluding":"9.0"}`

References

http://www.securityfocus.com/bid/101174
https://ics-cert.us-cert.gov/advisories/ICSA-17-278-01
http://www.securityfocus.com/bid/101174
https://ics-cert.us-cert.gov/advisories/ICSA-17-278-01

CWEs

CWE-121 CWE-119

Verify integrity in audit chain (admin only). AS-IS.