CVE-2022-31465

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Xpedition Designer VX.2.10 (All versions < VX.2.10 Update 13), Xpedition Designer VX.2.11 (All versions < VX.2.11 Update 11), Xpedition Designer VX.2.12 (All versions < VX.2.12 Update 5), Xpedition Designer VX.2.13 (All versions < VX.2.13 Update 1). The affected application assigns improper access rights to the service executable. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Siemens	Xpedition Designer VX.2.10	All versions < VX.2.10 Update 13
Siemens	Xpedition Designer VX.2.11	All versions < VX.2.11 Update 11
Siemens	Xpedition Designer VX.2.12	All versions < VX.2.12 Update 5
Siemens	Xpedition Designer VX.2.13	All versions < VX.2.13 Update 1

References

https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-988345.pdfVendor Advisory

Timeline

Published: Jun 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-314667.0Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privil CVE-2022-314677.3A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege CVE-2022-314686.1OX App Suite through 8.2 allows XSS via an attachment or OX Drive content when a client uses the len or off parameter.CVE-2022-314696.1OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.CVE-2022-31476.5Mattermost version 7.0.x and earlier fails to sufficiently limit the in-memory sizes of concurrently uploaded JPEG images, which allows auth CVE-2022-314706.1An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 1 CVE-2022-314717.5untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts XML external en CVE-2022-314724.3Browse restriction bypass vulnerability in Cabinet of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to obtain the data CVE-2022-314737.7In BIG-IP Versions 16.1.x before 16.1.1 and 15.1.x before 15.1.4, when running in Appliance mode, an authenticated attacker may be able to b CVE-2022-314747.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.Th CVE-2022-314754.9Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.CVE-2022-314765.5Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable denial of