Siemens Spectrum Power 4 Command Injection Vulnerability in User Interface

A vulnerability exists in Siemens Spectrum Power 4, all versions prior to 4.70 SP12 Update 2, allowing arbitrary command execution through the user interface. This interface, accessible via the network, enables the execution of commands as an administrative application user.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system, with the commands being executed as an administrative application user.

Remediation

Users are advised to update Siemens Spectrum Power 4 to version 4.70 SP12 Update 2 or later. For further inquiries on security vulnerabilities in Siemens products, contact Siemens ProductCERT.