← Back

CVE-2022-23450

nvd nist
Published: Apr 12, 2022Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Affected (4)

Siemens
2 products
Simatic Energy Manager Basic
Simatic Energy Manager Pro
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Siemens
Simatic Energy Manager Basic
Before 7.3
Simatic Energy Manager Basic
Version 7.3
Siemens
Simatic Energy Manager Pro
Before 7.3
Simatic Energy Manager Pro
Version 7.3

Related CWEs

CWE-502
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

Source: productcert@siemens.com
MitigationPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationPatchVendor Advisory

Timeline

No history available yet.