CVE-2022-23450 Deserialization in SIMATIC Energy Manager Basic

What is CVE-2022-23450?

CVE-2022-23450 is a critical unsafe deserialization vulnerability in Siemens SIMATIC Energy Manager Basic, published on 12 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Weakness: CWE-502

Which versions are affected by CVE-2022-23450?

It affects 2 products.

Products include Siemens Simatic Energy Manager Basic, Siemens Simatic Energy Manager Pro.

How do I fix CVE-2022-23450?

No fix has been published for CVE-2022-23450 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-23450 being exploited?

There is no known exploitation of CVE-2022-23450 in the wild and no public exploit code.

Other vulnerabilities in Siemens SIMATIC Energy Manager Basic

• CVE-2022-23448 Privilege escalation in SIMATIC Energy Manager Basic High 7.8
• CVE-2022-23449 Privilege escalation in SIMATIC Energy Manager Basic High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xrj9-8xhq-9gjh.