PT-2022-3582 · Siemens · Simatic Energy Manager Pro+1

Published 2022-04-12 · Updated 2022-04-19 · CVE-2022-23449

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC Energy Manager Basic versions prior to V7.3 Update 1 SIMATIC Energy Manager PRO versions prior to V7.3 Update 1

Description A DLL Hijacking issue could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path. The vulnerability is related to an uncontrolled element in the path search when loading DLL libraries, which may enable an attacker to execute arbitrary code.

Recommendations For SIMATIC Energy Manager Basic versions prior to V7.3 Update 1, update to V7.3 Update 1 or later to resolve the issue. For SIMATIC Energy Manager PRO versions prior to V7.3 Update 1, update to V7.3 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the directories on the DLL search path to minimize the risk of exploitation.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2022-04366

CVE-2022-23449

Affected Products

Simatic Energy Manager Basic

Simatic Energy Manager Pro

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-655554.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23449 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23449 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04366 · Security Note