Summary
Siemens SINEC NMS when used with User Management Component (UMC) contains an authentication bypass vulnerability due to insufficient validation of user identity. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application.
Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
Vulnerabilities 1
-
High 7.3
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains …
Revision history
-
#2
Initial CISA Republication of Siemens ProductCERT SSA-801704 advisory
-
#1
Publication Date
References
-
SSA-801704: Authentication Bypass Vulnerability in SINEC NMS - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-801704.html
-
ICS Advisory ICSA-26-111-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-03
-
Recommended Practices
https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b