A local privilege escalation vulnerability in Siemens Spectrum Power 4 allows attackers with low-level local access to elevate their privileges to administrative status.

The application is susceptible to a local privilege escalation flaw, categorized under CWE-266, caused by incorrectly configured permissions on a binary that permits any authenticated local user to execute commands with elevated administrative privileges.

This vulnerability presents a high risk to operational security, as a successful exploit allows a local attacker to bypass access controls and gain full administrative control over the affected system. Given the CVSS score of 7.8, this flaw could lead to complete system compromise, unauthorized data modification, or service disruption, which is particularly critical for industrial control environments relying on Spectrum Power 4.

Immediate Action: Update Siemens Spectrum Power 4 to version V4.70 SP12 Update 2 or later to apply the necessary permission corrections.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or execute system binaries by non-administrative user accounts.

Compensating Controls: Restrict local access to the server environment to trusted personnel only and ensure that user accounts follow the principle of least privilege.

Public Exploit Available: No (exploit_available: false)

The vulnerability represents a significant security weakness that could lead to full system compromise. System administrators should prioritize the deployment of the vendor-supplied update immediately to ensure that file permissions are properly restricted and to prevent privilege escalation by local actors.