Product by Siemens
Siemens Spectrum Power 4
15 known vulnerabilities in Siemens Spectrum Power 4 (Siemens), 4 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
4
Actively exploited (KEV)
2
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 15 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 15 other products | 8.1 | |
| Critical | CVE-2021-44228 | Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomwarealso in 75 other products | 10.0 | |
| Critical | CVE-2021-45046 | Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomwarealso in 23 other products | 9.0 | |
| Critical | CVE-2019-6579 | Siemens Spectrum Power™ 4: Command Injection | 9.8 | |
| High | CVE-2024-32011 | Siemens Spectrum Power 4: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| Medium | CVE-2019-10933 | Siemens Spectrum Power: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 6.1 | |
| High | CVE-2022-26476 | Siemens Spectrum Power 4: Use of Hard-coded Credentials | 8.8 | |
| Medium | CVE-2020-15790 | Siemens Spectrum Power 4: Exposure of Information Through Directory Listing | 5.3 | |
| High | CVE-2024-32008 | Siemens Spectrum Power 4: Incorrect Use of Privileged APIs | 7.8 | |
| High | CVE-2024-32010 | Siemens Spectrum Power 4: Incorrect Permission Assignment for Critical Resource | 7.8 | |
| High | CVE-2024-32009 | Siemens Spectrum Power 4: Incorrect Privilege Assignment | 7.8 | |
| Medium | CVE-2022-23312 | Siemens Spectrum Power 4: Cross-site Scripting | 6.1 | |
| Medium | CVE-2020-15784 | Siemens Spectrum Power 4: Cleartext Storage of Sensitive Information | 5.3 | |
| Medium | CVE-2024-32014 | Siemens Spectrum Power 4: Incorrect Permission Assignment for Critical Resource | 4.7 |
News
- PHP2Shell plus Fragnesia: A dangerous new route from web server to rootcsoonline,
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)unit42,
- PHP2Shell will persist in enterprise environments for yearscsoonline,
- Vulnerabilities in PHP Affecting Cisco Products: October 2026cisco-psirt,
- Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)cert-fr,
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,