Emerson Proficy Machine Edition
Proficy Machine Edition Version 9.00 and prior has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.CVE-2022-2793 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Proficy Machine Edition Version 9.00 and prior stores project data in a directory with improper access control lists.CVE-2022-2792 has been assigned to this vulnerability. A CVSS v3 base score of 6.6 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H). Proficy Machine Edition Version 9.00 and prior will upload any file written into the PLC logic folder to the connected PLC.CVE-2022-2791 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N). Proficy Machine Edition Version 9.00 and prior does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).CVE-2022-2790 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N). Proficy Machine Edition Version 9.00 and prior can display logic that is different than the compiled logic.CVE-2022-2789 has been assigned to this vulnerability. A CVSS v3 base score of 4.7 has been assigned; the CVSS vector string is (AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Proficy Machine Edition Version 9.80 and prior is vulnerable to a ZipSlip attack through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.CVE-2022-2788 has been assigned to this vulnerability. A CVSS v3 base score of 3.9 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L).