{"id":"CVE-2022-31465","aliases":["EUVD-2022-52929","GHSA-hc9x-33vv-56w7"],"status":"published","title":"A vulnerability has been identified in Xpedition Designer (All versions \u003c VX.2.11). The affected...","description":"A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions \u003c VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions \u003c VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions \u003c VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions \u003c VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00209,"percentile":0.11174,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2022-06-14T09:21:56Z","modified":"2026-06-17T04:45:28Z","products":[{"vendor":"siemens","product":"xpedition designer vx.2.10"},{"vendor":"siemens","product":"xpedition designer vx.2.11"},{"vendor":"siemens","product":"xpedition designer vx.2.12"},{"vendor":"siemens","product":"xpedition designer vx.2.13"},{"vendor":"siemens","product":"xpedition_designer"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31465"},{"url":"https://github.com/advisories/GHSA-hc9x-33vv-56w7"}],"sources":{"cve":[{"id":"CVE-2022-31465","description":"A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions \u003c VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions \u003c VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions \u003c VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions \u003c VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.","status":"published","published":"2022-06-14T09:21:56Z","modified":"2025-04-21T13:53:02.256Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-52929","description":"A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions \u003c VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions \u003c VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions \u003c VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions \u003c VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.","status":"published","published":"2022-06-14T09:21:56Z","modified":"2025-04-21T13:53:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-hc9x-33vv-56w7","title":"A vulnerability has been identified in Xpedition Designer (All versions \u003c VX.2.11). The affected...","description":"A vulnerability has been identified in Xpedition Designer (All versions \u003c VX.2.11). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.","status":"published","published":"2022-06-15T00:00:28Z","modified":"2023-01-27T05:04:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:42:31.605047Z"}],"nvd":[{"id":"CVE-2022-31465","description":"A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions \u003c VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions \u003c VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions \u003c VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions \u003c VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.","status":"published","published":"2022-06-14T10:15:20.547Z","modified":"2026-06-17T04:45:28.93Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:07:22.232533Z"}]}}