Summary
The latest update for SINEC NMS fixes a vulnerability that could allow an authenticated remote attacker to execute arbitrary code on the system, with system privileges, under certain conditions.
Siemens has released an update for SINEC NMS and recommends to update to the latest version.
Vulnerabilities 1
-
Unscored —
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutra…
Revision history
-
#3
Revision - Fixing typos
-
#2
Updated acknowledgements
-
#1
Publication Date
References
-
SSA-756744: OS Command Injection Vulnerability in SINEC NMS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-756744.txt
-
SSA-756744: OS Command Injection Vulnerability in SINEC NMS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-756744.pdf
-
ICS Advisory ICSA-21-222-04 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-222-04
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B