CVE-2022-23450: siemens simatic_energy_manager_basic Deserialization of Untrusted Data

Vulnerability summary

CVE-2022-23450 is a high (CVSS 10.0) Deserialization of Untrusted Data vulnerability in siemens simatic_energy_manager_basic. EPSS estimates a 35.75% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities.

Timeline

1. 12-04-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.