CVE-2022-23449

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Siemens	SIMATIC Energy Manager Basic	All versions < V7.3 Update 1
Siemens	SIMATIC Energy Manager PRO	All versions < V7.3 Update 1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdfMitigation, Patch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdfMitigation, Patch, Vendor Advisory

Timeline

Published: Apr 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-23457.8Use After Free in GitHub repository vim/vim prior to 9.0.0046.CVE-2022-234509.8A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions CVE-2022-234518.1An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user t CVE-2022-234524.9An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. T CVE-2022-234537.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234547.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234557.8Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, comprom CVE-2022-234565.5Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software.CVE-2022-234579.8ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the de CVE-2022-234586.1Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting CVE-2022-234599.8Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memor CVE-2022-23464.3In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.