PT-2022-17889 · Siemens · Shared His+3

Published 2022-06-14 · Updated 2022-06-22 · CVE-2022-26476

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:A/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Spectrum Power 4 versions using Shared HIS Spectrum Power 7 versions using Shared HIS Spectrum Power MGMS versions using Shared HIS

Description A vulnerability has been identified that allows an unauthenticated attacker to log into the Shared HIS component used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the Shared HIS component with administrative privileges.

Recommendations For Spectrum Power 4 versions using Shared HIS, change the default credentials of the Shared HIS account to prevent unauthorized access. For Spectrum Power 7 versions using Shared HIS, change the default credentials of the Shared HIS account to prevent unauthorized access. For Spectrum Power MGMS versions using Shared HIS, change the default credentials of the Shared HIS account to prevent unauthorized access.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-26476

Affected Products

Shared His

Spectrum Power 4

Spectrum Power 7

Spectrum Power Mgms

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-388239.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26476 · Security Note
• https://t.me/cvenotify/32021 · Telegram Post