CVE-2014-0750 in Intelligent Platforms Proficy Hmi
Summary
by MITRE
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/23/2025
The CVE-2014-0750 vulnerability represents a critical directory traversal flaw within the gefebt.exe component of GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY systems. This vulnerability exists within the WebView CimWeb components and affects versions through 8.2 SIM 24, as well as Proficy Process Systems with CIMPLICITY. The flaw enables remote attackers to execute arbitrary code through carefully crafted HTTP requests that exploit the directory traversal mechanism. This vulnerability was identified and catalogued as ZDI-CAN-1622 by the Zero Day Initiative, highlighting its significance in industrial control system security.
The technical implementation of this vulnerability stems from inadequate input validation within the gefebt.exe process that handles HTTP requests in the CimWeb component. When processing HTTP requests, the system fails to properly sanitize or validate file paths, allowing attackers to manipulate directory traversal sequences such as ../ or ..\ to access files outside the intended directory structure. This weakness directly maps to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as directory traversal or path traversal attacks. The vulnerability allows an attacker to bypass normal access controls and potentially gain unauthorized access to sensitive system files, configuration data, or execute malicious code with the privileges of the affected service.
The operational impact of CVE-2014-0750 in industrial environments is particularly severe as it targets critical infrastructure monitoring and control systems. Attackers exploiting this vulnerability could potentially gain full control over the affected HMI/SCADA systems, leading to disruption of industrial processes, data manipulation, or complete system compromise. The remote execution capability means that attackers do not require physical access to the systems, making this vulnerability especially dangerous for operational technology environments where security boundaries may be less strictly enforced. This vulnerability directly aligns with ATT&CK technique T1210, which covers exploitation of remote services, and could enable further lateral movement within industrial networks. The impact extends beyond immediate system compromise to potentially affect production processes, safety systems, and overall operational integrity of critical infrastructure.
Mitigation strategies for CVE-2014-0750 should focus on immediate patching of affected systems, as GE released updates to address this vulnerability. Network segmentation and access controls should be implemented to limit exposure of affected systems to untrusted networks. Regular security assessments of industrial control systems should include vulnerability scanning specifically targeting known weaknesses in HMI/SCADA components. Implementing network monitoring and intrusion detection systems can help identify suspicious HTTP traffic patterns that may indicate exploitation attempts. Organizations should also consider implementing web application firewalls to filter malicious HTTP requests and establish robust change management processes to ensure timely application of security patches. The vulnerability underscores the importance of maintaining current security patches for industrial control systems, as outdated components represent significant risk vectors for industrial espionage and operational disruption.