CVE-2012-2516

An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
icscertCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
geintelligent_platforms_proficy_batch_execution
5.6
geintelligent_platforms_proficy_historian
3.1
geintelligent_platforms_proficy_historian
3.5
geintelligent_platforms_proficy_historian
4.0
geintelligent_platforms_proficy_historian
4.5
geintelligent_platforms_proficy_hmi\/scada_ifix
5.0
geintelligent_platforms_proficy_hmi\/scada_ifix
5.1
geintelligent_platforms_proficy_pulse
1.0
geintelligent_platforms_si7_i\/o_driver
7.20
geintelligent_platforms_si7_i\/o_driver
7.42
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf
http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf
http://support.ge-ip.com/support/resources/sites/GE_FANUC_SUPPORT/content/live/KB/14000/KB14863/en_US/GEIP12-04%20Security%20Advisory%20-%20Proficy%20HTML%20Help.pdf
http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-02.pdf