Vulnerability in Siemens Spectrum Power 4
CVE-2022-26476
A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the component Shared HIS with administrative privileges.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (31.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Siemens Spectrum Power 4 — versions All versions using Shared HIS
- Siemens Spectrum Power 4
- Siemens Spectrum Power 7 — versions All versions using Shared HIS
- Siemens Spectrum Power 7
- Siemens Spectrum Power Mgms — versions All versions using Shared HIS
- Siemens Spectrum Power Microgrid Management System
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26476?
- CVE-2022-26476 is a high-severity vulnerability in Siemens Spectrum Power 4, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2022-06-14.
- How severe is CVE-2022-26476?
- High severity. CVSS v3 base score is 8.8 out of 10.