VulnerabilityDeferred

CVE-2024-32011

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2).

HIGH 8.7EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.39% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-829
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-339694.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.