CVE-2013-2811

highpriority · track · 29EPSS 0.018 · 79 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.85% (79th) EPSS
CVSS 7.1 · high
Is it mine?
30 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationCatapult Software DNP driver (“DNP”)cisa_csaf_ot

    The researchers suggest blocking DNP3 traffic from traversing onto business or corporate networks through the use of an IPS or firewall with DNP3-specific rule sets to add an additional layer of protection.

  • MitigationProficy human-machine interface/supervisory control and data acquisition (HMI/SCADA) – iFIX or CIMPLICITY servers with the vulnerable I/O Driver installed (this includes iFIX or CIMPLICITY installations that are part of Proficy Process Systems)cisa_csaf_ot

    The researchers suggest blocking DNP3 traffic from traversing onto business or corporate networks through the use of an IPS or firewall with DNP3-specific rule sets to add an additional layer of protection.

  • MitigationProficy HMI/SCADA—iFIX or CIMPLICITY servers with the vulnerable I/O Driver installed (this includes iFIX or CIMPLICITY installations that are part of Proficy Process Systems)cisa_csaf_ot

    The researchers suggest blocking DNP3 traffic from traversing onto business or corporate networks through the use of an IPS or firewall with DNP3-specific rule sets to add an additional layer of protection.

  • MitigationProficy human-machine interface/supervisory control and data acquisition (HMI/SCADA) DNP3 I/O Driver (“DNP”)cisa_csaf_ot

    The researchers suggest blocking DNP3 traffic from traversing onto business or corporate networks through the use of an IPS or firewall with DNP3-specific rule sets to add an additional layer of protection.

  • MitigationCIMPLICITYcisa_csaf_ot

    To obtain the latest version of any I/O driver please visit GE’s web site at (http://support.ge-ip.com) and, in the right column, look for “Quick Picks” > “Downloads” > “I/O Drivers.”

    http://support.ge-ip.com
  • MitigationCatapultcisa_csaf_ot

    To obtain the latest version of any I/O driver please visit GE’s web site at (http://support.ge-ip.com) and, in the right column, look for “Quick Picks” > “Downloads” > “I/O Drivers.”

    http://support.ge-ip.com
  • MitigationProficy HMI/SCADA DNP3 I/O Driver (DNP)cisa_csaf_ot

    To obtain the latest version of any I/O driver please visit GE’s web site at (http://support.ge-ip.com) and, in the right column, look for “Quick Picks” > “Downloads” > “I/O Drivers.”

    http://support.ge-ip.com
  • MitigationProficy HMI/SCADA – iFIX or CIMPLICITY servers with the vulnerable I/O Driver installed (this includes iFIX or CIMPLICITY installations that are part of Proficy Process Systemscisa_csaf_ot

    To obtain the latest version of any I/O driver please visit GE’s web site at (http://support.ge-ip.com) and, in the right column, look for “Quick Picks” > “Downloads” > “I/O Drivers.”

    http://support.ge-ip.com
  • MitigationiFixcisa_csaf_ot

    To obtain the latest version of any I/O driver please visit GE’s web site at (http://support.ge-ip.com) and, in the right column, look for “Quick Picks” > “Downloads” > “I/O Drivers.”

    http://support.ge-ip.com
02

cvss

Technical severity, 0–10. One row per scoring source.

7.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6–7.8

v2.07.1highAV:N/AC:M/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 6.9
v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Csecondary · CISA US
v2.06mediumAV:N/AC:M/Au:N/C:N/I:N/A:C/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USprimaryCWE-20US
04

affected products (30)

Products and version ranges known to be affected.

showing 20 of 30
05

advisories (3)

Vendor and ecosystem advisories describing this.

  • ICSA-13-297-01Catapult Software DNP3 Driver Improper Input Validation2013-07-27icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

  • ICSA-13-297-02GE Proficy DNP3 Improper Input Validation2013-07-27icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

  • ICSA-14-287-01GE Proficy HMI/SCADA DNP3 Driver Input Validation2014-07-17icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2013-11-22modified 2026-06-16
09

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan