Spectrum Power 4 vulnerabilities

7 known vulnerabilities in Spectrum Power 4 from Siemens. 7 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Spectrum Power 4: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2024-32011Nov 11, 2025Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of c

• 7.8 High severity

  Spectrum Power 4: Incorrect Permission Assignment for Critical Resource

  CVE-2024-32010Nov 11, 2025Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database

• 7.8 High severity

  Spectrum Power 4: Incorrect Privilege Assignment

  CVE-2024-32009Nov 11, 2025Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to wrongly set permissions to a binary which allows any local attacker to gain administrati

• 7.8 High severity

  Spectrum Power 4: Incorrect Use of Privileged APIs

  CVE-2024-32008Nov 11, 2025Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to a local privilege escalation due to an exposed debug interface on the localhost. This allows any local user to gain code exe

• 8.8 High severity

  Spectrum Power 4: Use of Hard-coded Credentials

  CVE-2022-26476Jun 14, 2022Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS

• 9.0 Critical severity

  Apache Log4j2 Deserialization of Untrusted Data Exploited

  CVE-2021-45046Dec 14, 2021ApacheEPSS 100%

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default

• 10.0 Critical severity

  Apache Log4j2 Remote Code Execution Exploited

  CVE-2021-44228Dec 10, 2021ApacheEPSS 100%

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c