General Electric MiCOM S1 Agile Vulnerability

CVE-2023-0898 is considered a medium threat level and maps to the common weakness enumeration ID of 427 (CWE-427), which states that this vulnerability is frequently introduced when a product uses a directory search path to find executables or code libraries, but the path contains a directory that can be modified by an attacker, such as “/tmp” or the current working directory. The flaw in the General Electric MiCOM S1 Agile software enables the attacker to achieve code execution by placing malicious DLL files in the directory of the application. The impact can range from malware execution to an attacker gaining full control over a compromised machine. This is not considered exploitable remotely; an attacker would need to inject these files manually, and no known public exploits target this vulnerability.