PT-2025-46535 · Schneider Electric · Spectrum Power

Published 2025-11-11 · Updated 2025-11-12 · CVE-2024-32010

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spectrum Power versions prior to 4.70 SP12 Update 2

Description The application is susceptible to the exposure of database credentials through a world-readable credential file. Successful exploitation allows an attacker to connect to the database with elevated privileges as an application user and execute system commands via the database.

Recommendations Update to version 4.70 SP12 Update 2 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2025-14349

CVE-2024-32010

Affected Products

Spectrum Power

References · 6

• https://bdu.fstec.ru/vul/2025-14349 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32010 · Security Note
• https://t.me/CVEtracker/37079 · Telegram Post
• https://twitter.com/CVEnew/status/1988348969005539611 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-339694.html · Note
• https://twitter.com/VulmonFeeds/status/1988408770234351711 · Twitter Post