CVE-2022-23448: High severity siemens simatic energy manager basic vulnerability
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23448?
CVE-2022-23448 is rated as a high severity vulnerability due to its potential impact on critical directory and file permissions.
How do I fix CVE-2022-23448?
To fix CVE-2022-23448, upgrade the affected Siemens SIMATIC Energy Manager Basic and Pro applications to version 7.3 Update 1 or later.
Which versions are affected by CVE-2022-23448?
CVE-2022-23448 affects all versions of SIMATIC Energy Manager Basic and Pro prior to version 7.3 Update 1.
What types of attacks can exploit CVE-2022-23448?
CVE-2022-23448 can be exploited by attackers to gain unauthorized access to sensitive application processes due to improper permission assignments.
Is there a workaround for CVE-2022-23448?
There are no documented workarounds for CVE-2022-23448, so upgrading to the fixed versions is the recommended action.