Medium severity · published Feb 14, 2023
CVE-2022-35868
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1),…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (All versions < V1.1), TIA Project-Server V16 (All versions), TIA Project-Server V17 (All versions < V17 Update 6). Affected applications contain an untrusted search path vulnerability that could allow an attacker to escalate privileges, when tricking a legitimate user to start the service from an attacker controlled path.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
TIA Multiuser Server V14 · Siemens
0 · source: vendor
TM
TIA Multiuser Server V15 · Siemens
All versions < V15.1 Update 8 · source: vendor
TP
TIA Project-Server · Siemens
All versions < V1.1 · source: vendor, NVD
TP
TIA Project-Server V16 · Siemens
0 · source: vendor
TP
TIA Project-Server V17 · Siemens
All versions < V17 Update 6 · source: vendor
TM
Tia Multiuser Server · Siemens
14; 15; 15.1; 16 · source: NVD