Log in Start free

Vulnerability · Published Jun 14, 2022 · Assigned by siemens

CVE-2022-31465

High 7.8

In plain English

A high-severity incorrect permission assignment in Xpedition Designer VX.2.10 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 88.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions < VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions < VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

Affected products (as reported)

VendorProductVersions
Siemens Xpedition Designer VX.2.10 All versions < VX.2.10 Update 13
Siemens Xpedition Designer VX.2.11 All versions < VX.2.11 Update 11
Siemens Xpedition Designer VX.2.12 All versions < VX.2.12 Update 5
Siemens Xpedition Designer VX.2.13 All versions < VX.2.13 Update 1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References