CVE-2022-45147

A vulnerability has been identified in SIMATIC PCS neo V4.0 (All versions), SIMATIC STEP 7 V16 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions < V18 Update 2). Affected applications do not properly restrict the .NET BinaryFormatter when deserializing user-controllable input. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application. This is the same issue that exists for .NET BinaryFormatter https://docs.microsoft.com/en-us/visualstudio/code-quality/ca2300.

• CWE-502

• https://cert-portal.siemens.com/productcert/html/ssa-825651.html
• https://cert-portal.siemens.com/productcert/html/ssa-825651.html

Published

Jul 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-45141Since the Windows Kerberos RC4-HMAC Elevation of Privilege V…9.8
• CVE-2022-45142The fix for CVE-2022-3437 included changing memcmp to be con…7.5
• CVE-2022-45143The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to …7.5
• CVE-2022-45144Algoo Tracim before 4.4.2 allows XSS via HTML file upload.6.1
• CVE-2022-45145egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary…9.8
• CVE-2022-45146An issue was discovered in the FIPS Java API of Bouncy Castl…5.5
• CVE-2022-45148Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-45149A vulnerability was found in Moodle which exists due to insu…5.4
• CVE-2022-4515A flaw was found in Exuberant Ctags in the way it handles th…7.8
• CVE-2022-45150A reflected cross-site scripting vulnerability was discovere…6.1
• CVE-2022-45151The stored-XSS vulnerability was discovered in Moodle which …5.4
• CVE-2022-45152A blind Server-Side Request Forgery (SSRF) vulnerability was…9.1