CVE-2024-32010

State: Published
Severity: 8.5 High
Published: Nov 11, 2025
Updated: Nov 12, 2025
Reserved: Apr 8, 2024

Description

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run system commands via the database.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	siemens
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	siemens

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
Spectrum Power 4Siemens	before V4.70 SP12 Update 2Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-339694.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.