Siemens Spectrum Power 4 Local Privilege Escalation Vulnerability Allowing Code Execution as Administrative User

A local privilege escalation vulnerability has been identified in Siemens Spectrum Power 4, affecting all versions prior to 4.70 SP12 Update 2. The vulnerability arises from an exposed debug interface on localhost, which allows any local user to execute code as an administrative application user.

Impact

Exploitation of this vulnerability allows local users to gain administrative privileges within the application and execute code as an administrative user.

Remediation

Users are advised to update to Siemens Spectrum Power 4 version 4.70 SP12 Update 2 or later. For guidance on applying the update, refer to the general security recommendations provided by Siemens.