High SSA-250085 3 CVEs

SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server

Published Mar 8, 2022 · Updated Oct 10, 2023 · Revision 4

Vendor: Siemens Product: SINEC NMS Product: SINEMA Server V14

Summary

SINEC NMS and SINEMA Server V14 contain multiple vulnerabilities that could allow an attacker to execute arbitrary code on the system, arbitrary commands on the local database or achieve privilege escalation.

Siemens has released several updates for SINEC NMS and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 3

High 7.3

CVE-2022-25311

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SI…

Siemens SINEC NMS SINEMA Server V14 ICS / OT

Mar 8, 2022
High 7.2

CVE-2022-24281

A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privilege…

Siemens SINEC NMS SINEMA Server V14 ICS / OT

Mar 8, 2022
High 7.2

CVE-2022-24282

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SI…

Siemens SINEC NMS SINEMA Server V14 ICS / OT

Mar 8, 2022

Revision history

2023-10-10 #4
Added fix for remaining vulnerabilities in SINEC NMS V2.0
2023-03-14 #3
Added SINEMA Server V14 to the list of affected products
2022-10-11 #2
Added fix for CVE-2022-24281 in SINEC NMS V1.0.3
2022-03-08 #1
Publication Date

References

SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-250085.html
SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-250085.txt