CVE-2023-3463
criticalpriority · track · 39EPSS 0.004 · 32 %ileEURUUSEPSS · scored 2026-10-27
All versions of GE Digital CIMPLICITY that are not adhering to SDG guidance and accepting documents from untrusted sources are vulnerable to memory corruption issues due to insufficient input validation, including issues such as out-of-bounds reads and writes, use-after-free, stack-based buffer overflows, uninitialized pointers, and a heap-based buffer overflow. Successful exploitation could allow an attacker to execute arbitrary code.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedCIMPLICITYcisa_csaf_ot
To obtain the latest versions of GE CIMPLICITY, contact your local GE Digital representative at https://digitalsupport.ge.com/s/contactsupport.
https://digitalsupport.ge.com/s/contactsupport - MitigationCIMPLICITYcisa_csaf_ot
Exploit is only possible if an authenticated user with local access to the system obtains and opens a document from a malicious source so secure deployment and strong access management by users is essential. GE Digital and customers have a shared responsibility for security and users are required to adhere to the most recent Secure Deployment Guide (SDG) instructions.
https://digitalsupport.ge.com/s/article/CIMPLICITY-Secure-Deployment-Guide2?language=en_US
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.6–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-23-199-06GE Digital CIMPLICITY2023-07-18icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to cause memory corruption issues resulting in unwanted behavior such as code execution.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-3463/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.4067cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06cnnvd
- https://www.ge.com/digital/applications/hmi-scada/cimplicityPatchcnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-06Third Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan