Summary
Multiple Siemens products are affected by two local privilege escalation vulnerabilities which could allow an low privileged attacker to load malicious DLLs, potentially leading to arbitrary code execution with elevated privileges.
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 2
-
High 7.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper m…
-
High 7.8
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versio…
Revision history
-
#4
CISA Republication update based on Siemens ProductCERT SSA-311973 advisory
-
#3
Added fix version for SINEC NMS for CVE-2026-25656
-
#2
CISA Republication - Initial CISA Republication of Siemens ProductCERT SSA-311973 advisory
-
#1
Publication Date
References
-
SSA-311973: Multiple Local Privilege Escalation Vulnerabilities in SINEC NMS and User Management Component (UMC) - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-311973.html
-
ICS Advisory ICSA-26-043-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-01
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b