Description
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run system commands via the database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Spectrum Power 4 | < V4.70 SP12 Update 2 | V4.70 SP12 Update 2 |
Advisories 3
- ICSA-25-317-12 Siemens Spectrum Power 4 CISA ICS & IT advisories · Nov 13, 2025
- NCSC-2025-0357 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 11, 2025
- SSA-339694 SSA-339694: Multiple Vulnerabilities in Spectrum Power 4 Before v4.70 SP12 Security Patch 2 Siemens ProductCERT · Nov 11, 2025