CVE-2022-23448
HIGHSIMATIC Energy Manager Basic and PRO < 7.3 Update 1 - Local Privilege Escalation via Improper Directory Permissions
Title source: llmDescription
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.
References (1)
Core 1
Core References
Mitigation, Patch, Vendor Advisory x_refsource_misc
https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf
Scores
CVSS v3
7.8
EPSS
0.0023
EPSS Percentile
14.0%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-732
Status
published
Products (4)
siemens/simatic_energy_manager_basic
7.3
siemens/simatic_energy_manager_basic
< 7.3
siemens/simatic_energy_manager_pro
7.3
siemens/simatic_energy_manager_pro
< 7.3
Published
Apr 12, 2022
Tracked Since
Feb 18, 2026