CVE-2022-23448: siemens simatic_energy_manager_basic

Vulnerability summary

CVE-2022-23448 is a high (CVSS 7.8) vulnerability in siemens simatic_energy_manager_basic. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.1% of scored vulnerabilities.

Timeline

1. 12-04-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.

• CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.