Vulnerability · Published Apr 12, 2022 · Assigned by siemens
CVE-2022-23449
High 7.3
In plain English
A high-severity uncontrolled search path in SIMATIC Energy Manager Basic from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Severity (CVSS NVD)7.3High
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC Energy Manager Basic | All versions < V7.3 Update 1 |
| Siemens | SIMATIC Energy Manager PRO | All versions < V7.3 Update 1 |
Weakness: CWE-427
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf x_refsource_MISC