Description
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26572).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SINEC NMS | < V4.0 | V4.0 |
Advisories 3
- NCSC-2025-0211 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jul 8, 2025
- ICSA-25-191-01 Siemens SINEC NMS CISA ICS & IT advisories · Jul 8, 2025
- SSA-078892 SSA-078892: Multiple Vulnerabilities in SINEC NMS Before V4.0 Siemens ProductCERT · Jul 8, 2025