CVE-2022-38469
highpriority · track · 30EPSS 0.006 · 49 %ileEURUUSEPSS · scored 2026-10-27
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedProficy Historiancisa_csaf_ot
GE Digital released Proficy Historian 2023 to mitigate these vulnerabilities. SIMs have also been released for all affected versions.
https://www.ge.com/digital/applications/proficy-historian - MitigationProficy Historiancisa_csaf_ot
Users can find out more about the vulnerabilities, how to obtain, and install the updates by visiting this notification document from GE Digital.
https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-23-017-01GE Digital Proficy Historian2023-01-17icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could crash the device after access, cause a buffer overflow condition, and allow remote code execution.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-38469/cnnvd
- https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01cnnvd
- https://www.ge.com/digital/applications/proficy-historianPatchcnnvd
- https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01enisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01enisa_euvd
- https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01Permissions RequiredVendor Advisorynvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01Third Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan