Paper/Archive/CVE-2022-23450

CVE-2022-23450

Siemens SIMATIC Energy Manager Basic — A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versi…

EPSS 36%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.5.985 × 2019.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Affected

ProductAffectedFixed inSource

SIMATIC Energy Manager BasicAll versions < V7.3 Update 1–CNA

SIMATIC Energy Manager PROAll versions < V7.3 Update 1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refcert-portal.siemens.com/productcert/pdf/ssa-655554.pdf