CVE-2022-25311highCWE-269

CVE-2022-25311: high-severity vulnerability in Siemens SINEC NMS

Published · Updated

Follow this CVE+ Monitor SINEC NMS+ Monitor SINEMA Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.3epss 0.5%
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
Affected products
Siemens · SINEC NMSSiemens · SINEMA Server V14
Related CVEs — Siemens SINEC NMS

In the same product, most dangerous first.

CVE-2021-33731—CVE-2021-33731EPSS 46.6%CVE-2021-37200—CVE-2021-37200EPSS 37.4%CVE-2021-33734—CVE-2021-33734EPSS 27.7%CVE-2021-33732—CVE-2021-33732EPSS 27.7%CVE-2021-33730—CVE-2021-33730EPSS 27.7%CVE-2020-25237—CVE-2020-25237EPSS 20.6%