CVE-2022-23448
HIGHSiemens Simatic Energy Manager Basic - Incorrect Permission Assignment
Title source: ruleDescription
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.
References (1)
Core 1
Core References
Mitigation, Patch, Vendor Advisory x_refsource_misc
https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
Scores
CVSS v3
7.8
EPSS
0.0003
EPSS Percentile
7.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-732
Status
published
Products (4)
siemens/simatic_energy_manager_basic
7.3
siemens/simatic_energy_manager_basic
< 7.3
siemens/simatic_energy_manager_pro
7.3
siemens/simatic_energy_manager_pro
< 7.3
Published
Apr 12, 2022
Tracked Since
Feb 18, 2026