CVE-2024-32011
published 2025-11-11CVE-2024-32011: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands…
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.35%
26.7th percentile
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | spectrum_power_4 | < V4.70 SP12 Update 2 | V4.70 SP12 Update 2 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2024-32011 is exploitable remotely via the Spectrum Power 4 user interface (network-accessible UI); monitor for unexpected or unauthorized command execution originating from the application's UI layer running as the administrative application user. ↗
- →Classify CVE-2024-32011 as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere); alert on network-sourced command execution events tied to the Spectrum Power 4 application process running with administrative privileges. ↗
- ·All versions of Spectrum Power 4 prior to V4.70 SP12 Update 2 are affected; the vulnerability is only remediated by updating to V4.70 SP12 Update 2 or later. ↗
- ·No known public exploitation specifically targeting CVE-2024-32011 has been reported to CISA at the time of advisory publication. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wrgq-x2fx-9ww7: A vulnerability has been identified in Spectrum Power 4 (All versions < V4
ghsa_unreviewed·2025-11-11
CVE-2024-32011 [HIGH] CWE-829 GHSA-wrgq-x2fx-9ww7: A vulnerability has been identified in Spectrum Power 4 (All versions < V4
A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application user.
CISA ICS
Siemens Spectrum Power 4
cisa_ics·2025-11-13·CVSS 7.8
[HIGH] Siemens Spectrum Power 4
ICS Advisory
##
Siemens Spectrum Power 4
Release DateNovember 13, 2025
Alert CodeICSA-25-317-12
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Spectrum Power 4
- Vulnerabilities: Incorrect Use of Privileged APIs, Incorrect Privilege Assignment, Incorrect Permission Assignmen
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-11
Published