CVE-2022-23449: siemens simatic_energy_manager_basic Uncontrolled Search Path Element

Vulnerability summary

CVE-2022-23449 is a high (CVSS 7.3) Uncontrolled Search Path Element vulnerability in siemens simatic_energy_manager_basic. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.3% of scored vulnerabilities.

Timeline

1. 12-04-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.

• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.