CVE-2022-23450

highPriorität · beachten · 52EPSS 0.357 · 98. PerzentilDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

—

no known exploitation

Likely / severe?

35.7% (98th) EPSS

CVSS 10 · high

Is it mine?

14 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC Energy Manager Basicsiemens_psirt
Update to V7.3 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808211/
BehobenSIMATIC Energy Manager PROsiemens_psirt
Update to V7.3 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808211/
BehobenSIMATIC Energy Manager Basiccisa_csaf_ot
Update to V7.3 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808211/
BehobenSIMATIC Energy Manager PROcisa_csaf_ot
Update to V7.3 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808211/
MitigationSIMATIC Energy Manager Basicsiemens_psirt
Enable encryption in the SIMATIC Energy Manager configuration
MitigationSIMATIC Energy Manager PROsiemens_psirt
Enable encryption in the SIMATIC Energy Manager configuration
MitigationSIMATIC Energy Manager Basiccisa_csaf_ot
Enable encryption in the SIMATIC Energy Manager configuration
MitigationSIMATIC Energy Manager PROcisa_csaf_ot
Enable encryption in the SIMATIC Energy Manager configuration

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 9–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 10

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-502USprimärCWE-502USCWE-502USCWE-502US

betroffene Produkte (14)

Betroffene Produkte und Versionsbereiche.

SIMATIC Energy Manager Basicalle Versionencisa_csaf_otUS
SIMATIC Energy Manager PROalle Versionencisa_csaf_otUS
Siemens SIMATIC Energy Manager Basic< V7.3_Update_1cisa_csaf_otUS
Siemens SIMATIC Energy Manager PRO< V7.3_Update_1cisa_csaf_otUS
Siemens SIMATIC Energy Manager BasicAll versions → V7.3 Update 1enisa_euvdEU
Siemens SIMATIC Energy Manager PROAll versions → V7.3 Update 1enisa_euvdEU
Siemens AG SIMATIC Energy Manager Basic≤ 7.3 Update 1fstec_bduRU
Siemens AG SIMATIC Energy Manager PRO≤ 7.3 Update 1fstec_bduRU
siemens simatic energy manager basic< 7.3nvdUScpe:2.3:a:siemens:simatic_energy_manager_basic:*:*:*:*:*:*:*:*
siemens simatic energy manager basic= 7.3nvdUScpe:2.3:a:siemens:simatic_energy_manager_basic:*:*:*:*:*:*:*:*
siemens simatic energy manager pro< 7.3nvdUScpe:2.3:a:siemens:simatic_energy_manager_pro:*:*:*:*:*:*:*:*
siemens simatic energy manager pro= 7.3nvdUScpe:2.3:a:siemens:simatic_energy_manager_pro:*:*:*:*:*:*:*:*
Siemens SIMATIC Energy Manager Basic< V7.3 Update 1siemens_psirtDE
Siemens SIMATIC Energy Manager PRO< V7.3 Update 1siemens_psirtDE

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-655554SSA-655554: Multiple Vulnerabilities in SIMATIC Energy Manager before V7.3 Update 12022-04-12csaf · siemens_psirtDE
SIMATIC Energy Manager is affected by multiple vulnerabilities that could allow an attacker to gain local privilege escalation, local code execution or remote code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.
ICSA-22-104-11Siemens SIMATIC Energy Manager2022-04-12icsa · cisa_csaf_otUS
SIMATIC Energy Manager is affected by multiple vulnerabilities that could allow an attacker to gain local privilege escalation, local code execution or remote code execution. Siemens has released updates for the affected products and recommends to update to the latest versions.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-04-12geändert 2026-06-17

verwandt (3,745)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-63077US	—OT kritisch	93.6% (100th)	KEV	2026-07-27
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-58644US	—OT kritisch	15.9% (97th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-50522US	—OT kritisch	3.04% (87th)	KEV	2026-07-14
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
CVE-2026-12569US	critical9.8OT kritisch	46.0% (99th)	KEV	2026-06-18
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of u…
CVE-2026-45247US	—OT kritisch	26.2% (98th)	KEV	2026-05-26
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code exec…

+3740 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan