Vulnerability in Siemens Spectrum Power 4
CVE-2022-26476
A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the component Shared HIS with administrative privileges.
EPSS: 0.004 (32.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Siemens Spectrum Power 4 — versions All versions using Shared HIS
- Siemens Spectrum_power_4
- Siemens Spectrum Power 7 — versions All versions using Shared HIS
- Siemens Spectrum_power_7
- Siemens Spectrum Power Mgms — versions All versions using Shared HIS
- Siemens Spectrum_power_microgrid_management_system
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-26476?
- CVE-2022-26476 is a high-severity vulnerability in Siemens Spectrum Power 4, classified under Use of Hard-coded Credentials. CVSS score: 8.8/10. Published 2022-06-14.
- How severe is CVE-2022-26476?
- High severity. CVSS v3 base score is 8.8 out of 10.