CVE-2020-7579: siemens ag spectrum power™ 5
Vulnerability summary
CVE-2020-7579 is a medium (CVSS 6.1) vulnerability in siemens ag spectrum power™ 5. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.3% of scored vulnerabilities.
Timeline
- 10-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to recommended system configuration, Siemens consideres the environmental vector as CR:L/IR:M/AR:H/MAV:A (4.1).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
55%
Versus all other CVEs
30-day change
0.00 pp
From 0.78% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Siemens1 product
- spectrum_power_5≤ 5.50 | 5.50:hf01
Siemens ag1 product
- spectrum power™ 5All versions < v5.50 HF02
2 vendors · 2 products