Multiple Vulnerabilities in SIMATIC Energy Manager before V7.3 Update 1

An attacker could gain elevated privileges or execute arbitrary code on the Energy Manager server, potentially allowing them to modify energy consumption data, disrupt power monitoring and control functions, or use the system as a foothold to attack connected electrical infrastructure.

Energy utilities and industrial sites running SIMATIC Energy Manager for power consumption monitoring and control. This includes municipal electric utilities, industrial facilities with onsite power management, and any organization using Siemens energy management software for facility operations.

An attacker with local access to the Energy Manager system could exploit weak file permissions or search path vulnerabilities to execute code with elevated privileges. Alternatively, an attacker with network access could send a malicious serialized object to trigger remote code execution if the application deserializes untrusted data.