CVE-2022-23448: Siemens SIMATIC Energy Manager Basic

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). Affected applications improperly assign permissions to critical directories and files used by the application processes. This could allow a local unprivileged attacker to achieve code execution with ADMINISTRATOR or even NT AUTHORITY/SYSTEM privileges.

Affected products

• Siemens SIMATIC Energy Manager Basic: before 7.3 (fixed in 7.3); version 7.3 only
• Siemens SIMATIC Energy Manager Pro: before 7.3 (fixed in 7.3); version 7.3 only

Published 2022-04-12. Last modified 2026-06-17.