CVE-2014-0751 in Intelligent Platforms Proficy Hmi
Summary
by MITRE
Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212, aka ZDI-CAN-1623.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/23/2025
The vulnerability identified as CVE-2014-0751 represents a critical directory traversal flaw within the CimWebServer.exe component of GE Intelligent Platforms Proficy HMI/SCADA CIMPLICITY software. This weakness exists in versions prior to 8.2 SIM 24 and affects both Proficy HMI/SCADA systems and Proficy Process Systems that utilize CIMPLICITY. The vulnerability manifests through the WebView component which serves as the web server interface for these industrial control systems, making it a significant concern for operational technology environments where security is paramount.
The technical implementation of this directory traversal vulnerability occurs through a crafted message sent to TCP port 10212, which is the default port used by the CimWebServer.exe process for communication. Attackers can exploit this flaw by sending specially constructed messages that manipulate the web server's file handling mechanisms to traverse directories and access files outside of the intended web root. This allows malicious actors to read arbitrary files, potentially including system configuration files, user credentials, or other sensitive data that should remain protected. The vulnerability stems from inadequate input validation and sanitization within the web server's handling of file paths, enabling attackers to bypass normal access controls through crafted requests.
The operational impact of this vulnerability is severe for industrial environments that rely on GE CIMPLICITY systems for process control and monitoring. Remote code execution capabilities provided by this vulnerability mean that attackers can potentially gain complete control over the affected systems, leading to disruption of industrial processes, data manipulation, or complete system compromise. The attack vector through TCP port 10212 presents a particular risk since this port is often exposed to external networks or accessible from untrusted environments, especially in industrial settings where network segmentation may be inadequate. This vulnerability directly aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, and represents a classic path traversal attack that can be leveraged for privilege escalation and system compromise.
Organizations utilizing affected GE CIMPLICITY systems should immediately implement mitigations including applying the vendor-provided security patches released as part of the 8.2 SIM 24 update. Network segmentation should be implemented to restrict access to TCP port 10212, and firewall rules should be configured to limit access to only trusted administrative networks. Additionally, monitoring should be enabled for unusual file access patterns or attempts to traverse directory structures. This vulnerability demonstrates the critical importance of securing industrial control systems against remote code execution threats and aligns with ATT&CK technique T1210 for exploiting weaknesses in remote services, emphasizing the need for robust network security controls in operational technology environments. The vulnerability also highlights the broader risk of unpatched industrial software components and the potential for attackers to leverage seemingly minor flaws to achieve significant operational disruption or compromise in critical infrastructure systems.