CVE-2021-37200CWE-22

CVE-2021-37200: vulnerability in Siemens SINEC NMS

Published · Updated

Follow this CVE+ Monitor SINEC NMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 37%
In short

A flaw in SINEC NMS allows someone with access to the web server to download any file from the system by sending a specially crafted request. This exposes sensitive files that should not be accessible.

Technical detail

Path traversal vulnerability (CWE-22) in SINEC NMS webserver allows authenticated or local attackers to retrieve arbitrary files from the underlying filesystem through malformed HTTP requests. Exploitation requires network access to the affected webserver and could lead to disclosure of sensitive configuration files, credentials, or system data.

Summary generated and translated by AI from the official description.
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request.
Affected products
Siemens · SINEC NMS
Related CVEs — Siemens SINEC NMS

In the same product, most dangerous first.

CVE-2021-33731—CVE-2021-33731EPSS 46.6%CVE-2021-33734—CVE-2021-33734EPSS 27.7%CVE-2021-33732—CVE-2021-33732EPSS 27.7%CVE-2021-33730—CVE-2021-33730EPSS 27.7%CVE-2020-25237—CVE-2020-25237EPSS 20.6%CVE-2021-33733—CVE-2021-33733EPSS 15.4%