Vulnerability · Published Jun 14, 2022 · Assigned by siemens

CVE-2022-26476

High 8.8

In plain English

A high-severity hard-coded credentials in Spectrum Power 4 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)0.4%top 64.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the component Shared HIS with administrative privileges.

Affected products (as reported)

Vendor	Product	Versions
Siemens	Spectrum Power 4	All versions using Shared HIS
Siemens	Spectrum Power 7	All versions using Shared HIS
Siemens	Spectrum Power MGMS	All versions using Shared HIS

Weakness: CWE-798

References

https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf x_refsource_MISC