Vulnerability in Siemens Spectrum Power 7
CVE-2023-44120
A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4). The affected product's sudo configuration permits the local administrative account to execute several entries as root user. This could allow an authenticated local attacker to inject arbitrary code and gain root access.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.001 (3.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 3.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Siemens Spectrum Power 7 — versions All versions < V23Q4
- Siemens Spectrum Power 7
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-786191.pdf (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-44120?
- CVE-2023-44120 is a high-severity vulnerability in Siemens Spectrum Power 7, classified under Incorrect Permission Assignment for Critical Resource. CVSS score: 7.8/10. Published 2024-01-09.
- How severe is CVE-2023-44120?
- High severity. CVSS v3 base score is 7.8 out of 10.