Read the docs
TI-2024-19293 Aliases CVE-2024-29119GHSA-r5rf-j64w-28qc

A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3).

Priority LOW 38CWE-266Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

A vulnerability has been identified in Spectrum Power 7 (All versions < V24Q3). The affected product contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Fixed Spectrum Power 7 (Siemens): V24Q3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSpectrum Power 7before V24Q3V24Q3Patch availableCNA
  • Spectrum Power 7 VendorSiemens Affected before V24Q3 Fixed in V24Q3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:*before 24q3VulnerableSiemens
  • cpe:2.3:a:siemens:spectrum_power_7:*:*:*:*:*:*:*:* Versions before 24q3 Vulnerable ·Siemens

Remediation

  • Fix · CNA Spectrum Power 7 (Siemens) Fixed in V24Q3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29119
  2. 2026-10-03 Alias added: GHSA-r5rf-j64w-28qc

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2022-09824 Hard-coded credentials in Siemens Spectrum Power 4 CVSS 3.1HIGH 8.8
  • TI-2023-19933 Incorrect permission assignment in Siemens Spectrum Power 7 CVSS 3.1HIGH 8.2
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences