critical9.3Public exploit code

CVE-2012-2516

An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

KeyHelp - ActiveX LaunchTriPane Remote Code Execution (Metasploit)2012-10-11 · remote · windows · Verified

Impact

An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."

Affected products

Vendor	Product	Affected versions
Ge	Intelligent Platforms Proficy Batch Execution	Version 5.6
Ge	Intelligent Platforms Proficy Historian	Versions 3.1, 3.5, 4.0, 4.5
Ge	Intelligent Platforms Proficy Hmi\/Scada Ifix	Versions 5.0, 5.1
Ge	Intelligent Platforms Proficy Pulse	Version 1.0
Ge	Intelligent Platforms Si7 I\/O Driver	Versions 7.20, 7.42

Weakness classification

CWE-78

Public exploit code

Impact

Affected products

Weakness classification

References