CVE-2014-0750: GE Proficy CIMPLICITY WebView gefebt.exe path traversal RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution in a SCADA/HMI product with very high EPSS probability, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

The WebView CimWeb component gefebt.exe in GE Proficy HMI/SCADA CIMPLICITY (through 8.2 SIM 24) and Proficy Process Systems with CIMPLICITY contains a directory traversal flaw (CWE-22). A crafted HTTP request can traverse paths and lead to arbitrary code execution on the HMI/SCADA host.

Impact

A remote attacker can execute arbitrary code on the SCADA server, potentially taking control of the HMI/SCADA system.

Attack surface

Reachable over the network via HTTP to the WebView CimWeb service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit tags in the references, but EPSS is 0.70223 (99.3rd percentile), indicating high predicted likelihood of exploitation activity.

What to do

• Apply the GE vendor advisory KB15939 fix or upgrade CIMPLICITY past 8.2 SIM 24.
• Restrict network access to the WebView CimWeb HTTP service to trusted hosts and segments.
• Place the SCADA web interface behind a firewall or reverse proxy that normalizes and rejects traversal sequences.
• Monitor vendor and ICS-CERT advisories for updated patches and workarounds.

Detection

• Inspect HTTP requests to gefebt.exe for ../ or encoded traversal sequences.
• Alert on unexpected process creation or file writes originating from the CimWeb/gefebt.exe process.
• Review web server logs for anomalous requests to CimWeb endpoints from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.