CVE-2022-2791 - Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC

Back Back to CVE browser

HIGH

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC

Published Nov 22, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.18%

Description

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.

Affected products

Vendor Emerson Electric Product Proficy Machine Edition Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=9.00

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Emerson Electric

Proficy Machine Edition

unaffected

Version	Status	Constraints
0	affected	<=9.00

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (1)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-06
government-resourceThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-06		government-resourceThird Party AdvisoryUS Government Resource

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner icscert

Published Nov 22, 2022

Updated Apr 16, 2025

Reserved Aug 11, 2022

Link CVE-2022-2791

CISA Vulnrichment

Updated Apr 16, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-2791

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-2791