CVE-2024-32011

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-339694.html

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary	(es) Se ha identificado una vulnerabilidad en Spectrum Power 4 (Todas las versiones < V4.70 SP12 Update 2). La aplicación afectada es vulnerable a la ejecución de comandos arbitrarios a través de la interfaz de usuario. Esta interfaz de usuario puede ser utilizada a través de la red y permite la ejecución de comandos como usuario administrativo de la aplicación.	(es) Se ha identificado una vulnerabilidad en Spectrum Power 4 (Todas las versiones anteriores a V4.70 SP12 Update 2). La aplicación afectada es vulnerable a la ejecución de comandos arbitrarios a través de la interfaz de usuario. Esta interfaz de usuario puede ser utilizada a través de la red y permite la ejecución de comandos como usuario administrativo de la aplicación.

26 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad en Spectrum Power 4 (Todas las versiones < V4.70 SP12 Update 2). La aplicación afectada es vulnerable a la ejecución de comandos arbitrarios a través de la interfaz de usuario. Esta interfaz de usuario puede ser utilizada a través de la red y permite la ejecución de comandos como usuario administrativo de la aplicación.

Information

Published : 2025-11-11 21:15

Updated : 2026-10-23 22:10

NVD link : CVE-2024-32011

Mitre link : CVE-2024-32011

CVE.ORG link : CVE-2024-32011

JSON object : View

Products Affected

No product.

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2024-32011", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-32011", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T21:07:33.051023Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "Spectrum Power 4", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.70 SP12 Update 2", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-11-11T21:15:35.623", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-339694.html", "source": "productcert@siemens.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en Spectrum Power 4 (Todas las versiones anteriores a V4.70 SP12 Update 2). La aplicaci\u00f3n afectada es vulnerable a la ejecuci\u00f3n de comandos arbitrarios a trav\u00e9s de la interfaz de usuario. Esta interfaz de usuario puede ser utilizada a trav\u00e9s de la red y permite la ejecuci\u00f3n de comandos como usuario administrativo de la aplicaci\u00f3n."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "productcert@siemens.com"}