CVE-2012-2516 in Intelligent Platforms Proficy Historian
Summary
by MITRE
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2025
The vulnerability identified as CVE-2012-2516 represents a critical command injection flaw within the ActiveX control KeyHelp.ocx, which forms part of the KeyWorks KeyHelp Module. This component serves as an HTML Help system integration within various GE Intelligent Platforms products, including Proficy Historian, HMI/SCADA iFIX, Proficy Pulse, and Batch Execution systems. The flaw exists in how the ActiveX control processes user input, creating an avenue for remote attackers to execute arbitrary commands on affected systems. The vulnerability specifically affects multiple versions of GE's industrial software suite, making it particularly concerning for operational technology environments where these systems are deployed. The command injection occurs through crafted input parameters that are improperly validated or sanitized before being processed by the ActiveX control.
This vulnerability operates at the intersection of several cybersecurity domains and aligns with CWE-77, which describes command injection vulnerabilities where untrusted data is incorporated into system commands without proper validation or sanitization. The ActiveX control's failure to properly validate input parameters creates a direct pathway for attackers to inject malicious commands that are then executed with the privileges of the affected application. The attack vector is particularly dangerous because it enables remote code execution without requiring authentication, as the vulnerability exists within a component that can be accessed through web-based interfaces or other remote access mechanisms. The flaw essentially allows an attacker to leverage the ActiveX control's functionality to execute arbitrary code on the target system, potentially leading to complete system compromise.
The operational impact of this vulnerability extends beyond traditional information technology environments into industrial control systems and critical infrastructure. Organizations running affected GE Proficy products face significant risks including unauthorized access to operational data, potential disruption of industrial processes, and possible compromise of safety-critical systems. The vulnerability's presence in multiple GE products means that a single exploitation could potentially affect entire industrial networks, as these systems often interconnect and share common infrastructure. The remote execution capability makes this particularly dangerous in environments where industrial systems are accessible over the internet or through unsecured networks, creating opportunities for attackers to gain persistent access to operational technology environments. This vulnerability directly impacts the principles of defense in depth and network segmentation that are fundamental to industrial cybersecurity practices.
Mitigation strategies for CVE-2012-2516 should focus on immediate remediation through vendor-provided patches and updates, as well as network-level protections. Organizations should implement strict network segmentation to limit access to systems running affected ActiveX controls, particularly those accessible from external networks. The implementation of application whitelisting policies can help prevent execution of unauthorized ActiveX controls, while regular security assessments should identify and remediate similar vulnerabilities in other components. Network monitoring and intrusion detection systems should be configured to detect suspicious command execution patterns that may indicate exploitation attempts. Additionally, organizations should consider disabling ActiveX controls in web browsers where they are not required, and maintain comprehensive inventory tracking of all ActiveX components deployed across their industrial control systems. The vulnerability demonstrates the importance of secure coding practices and input validation in all system components, regardless of their perceived security boundary, aligning with ATT&CK technique T1059.007 for command and script injection.