GE Intelligent Platforms Proficy Real-Time Information Portal Directory Traversal
Low RiskICS-CERT ICSA-12-032-03Nov 4, 2012
Summary
A directory traversal vulnerability in GE Vernova Proficy Real-Time Information Portal versions 2.6, 3.0, 3.0_SP1, and 3.5 allows an unauthenticated attacker with network access to the web interface to read arbitrary files from the server. No vendor patches are available; the affected versions are unsupported.
What this means
What could happen
An attacker with access to the Proficy Real-Time Information Portal could read arbitrary files from the server, potentially exposing sensitive configuration data, credentials, or process information needed to operate or compromise your facility.
Who's at risk
Water utilities, electric utilities, and other municipal operators using GE Vernova Proficy Real-Time Information Portal for SCADA data visualization and real-time monitoring are affected. This applies if the portal is accessible from your engineering network or control center displays.
How it could be exploited
An attacker with network access to the Proficy Portal could craft a malicious URL or web request using directory traversal sequences (like ../ or similar) to step outside the intended directory and access files elsewhere on the server. This requires no authentication or special privileges.
Prerequisites
- Network access to the Proficy Real-Time Information Portal web interface
- No authentication required
remotely exploitableno authentication requiredlow complexityno patch availableunsupported product versions
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (1)
ProductAffected VersionsFix Status
Proficy Real-Time Information Portal: 3.5|3.0_SP1|3.0|2.63.5|3.0 SP1|3.0|2.6No fix (EOL)
Remediation & Mitigation
0/3
Do now
0/2HARDENINGRestrict network access to the Proficy Real-Time Information Portal using firewall rules. Allow only trusted engineering workstations and control room displays; block direct access from untrusted networks or the internet.
WORKAROUNDIf the Proficy Portal is exposed to a network other than your isolated OT network, place it behind a reverse proxy or web application firewall (WAF) that can filter directory traversal attacks.
Mitigations - no patch available
0/1Proficy Real-Time Information Portal: 3.5|3.0_SP1|3.0|2.6 has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGEvaluate upgrade or replacement options for Proficy Real-Time Information Portal. No vendor patches are available for this vulnerability; long-term, moving to a supported product version or alternative is necessary.
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/864c502d-bffa-414d-8980-c4314c9cd169