Spectrum Power 7 vulnerabilities

6 known vulnerabilities in Spectrum Power 7 from Siemens. 6 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Spectrum Power 7: Incorrect Privilege Assignment

  CVE-2024-29119Nov 12, 2024Siemens

  A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges.

• 7.8 High severity

  Spectrum Power 7: Incorrect Permission Assignment for Critical Resource

  CVE-2023-44120Jan 9, 2024Siemens

  A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inje

• 7.8 High severity

  Spectrum Power 7: Incorrect Permission Assignment for Critical Resource

  CVE-2023-38557Sep 14, 2023Siemens

  A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the update script. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.

• 8.8 High severity

  Spectrum Power 4: Use of Hard-coded Credentials

  CVE-2022-26476Jun 14, 2022Siemens

  A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS

• 9.0 Critical severity

  Apache Log4j2 Deserialization of Untrusted Data Exploited

  CVE-2021-45046Dec 14, 2021ApacheEPSS 100%

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default

• 10.0 Critical severity

  Apache Log4j2 Remote Code Execution Exploited

  CVE-2021-44228Dec 10, 2021ApacheEPSS 100%

  Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c