Summary
A recent update for SINEC NMS fixed multiple vulnerabilities. The most severe of these vulnerabilities could allow an attacker to manipulate the SINEC NMS configuration by tricking an admin to click on a malicious link.
Siemens has released an update for SINEC NMS and recommends to update to the latest version.
Vulnerabilities 2
-
Unscored —CVE-2021-37200 EPSS 37%
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of…
-
Unscored —
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vu…
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-330339: Web Vulnerabilities in SINEC NMS - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-330339.txt
-
SSA-330339: Web Vulnerabilities in SINEC NMS - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-330339.pdf
-
ICS Advisory ICSA-21-257-14 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-257-14
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B