Vulnerability · Published Feb 14, 2023 · Assigned by siemens
CVE-2022-35868
Medium 6.7
In plain English
A medium-severity security flaw in TIA Multiuser Server V14 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | TIA Multiuser Server V14 | 0 – before * |
| Siemens | TIA Multiuser Server V15 | All versions < V15.1 Update 8 |
| Siemens | TIA Project-Server | All versions < V1.1 |
| Siemens | TIA Project-Server V16 | 0 – before * |
| Siemens | TIA Project-Server V17 | All versions < V17 Update 6 |
Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C