{"id":"CVE-2022-23448","aliases":["EUVD-2022-28523","GHSA-5hqf-83pf-c8gv"],"status":"published","title":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1...","description":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00249,"percentile":0.16301,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2022-04-12T09:07:35Z","modified":"2026-06-17T04:30:08Z","products":[{"vendor":"siemens","product":"simatic energy manager basic"},{"vendor":"siemens","product":"simatic energy manager pro"},{"vendor":"siemens","product":"simatic_energy_manager_basic"},{"vendor":"siemens","product":"simatic_energy_manager_pro"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf","tags":["x_refsource_MISC","x_transferred","Mitigation","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23448"},{"url":"https://github.com/advisories/GHSA-5hqf-83pf-c8gv"}],"sources":{"cve":[{"id":"CVE-2022-23448","description":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.","status":"published","published":"2022-04-12T09:07:35Z","modified":"2024-08-03T03:43:45.944Z","cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-28523","description":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.","status":"published","published":"2022-04-12T09:07:35Z","modified":"2024-08-03T03:43:45Z","updated_at":"2026-11-03T03:25:51.181739Z"}],"ghsa":[{"id":"GHSA-5hqf-83pf-c8gv","title":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1...","description":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.","status":"published","published":"2022-04-13T00:00:33Z","modified":"2023-01-27T05:01:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:41:55.795759Z"}],"nvd":[{"id":"CVE-2022-23448","description":"A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions \u003c V7.3 Update 1), SIMATIC Energy Manager PRO (All versions \u003c V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.","status":"published","published":"2022-04-12T09:15:14.233Z","modified":"2026-06-17T04:30:08.61Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:07:15.414503Z"}]}}