Proficy Machine Edition vulnerabilities

4 known vulnerabilities in Proficy Machine Edition from Emerson Electric. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Proficy Machine Edition: Unrestricted Upload of File with Dangerous Type

  CVE-2022-2791Nov 22, 2022Emerson Electric

  Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.

• 7.8 High severity

  Proficy Machine Edition: Insufficient Verification of Data Authenticity

  CVE-2022-2793Aug 19, 2022Emerson Electric

  Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.

• 7.5 High severity

  Proficy Machine Edition: Improper Access Control

  CVE-2022-2792Aug 19, 2022Emerson Electric

  Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.

• 7.3 High severity

  Proficy Machine Edition: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-2788Aug 19, 2022Emerson Electric

  Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file