Description
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through getTotalAndFilterCounts endpoint. An authenticated low privileged attacker could exploit to insert data and achieve privilege escalation. (ZDI-CAN-26570)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SINEC NMS | < V4.0 SP1 | V4.0 SP1 |
Advisories 3
- NCSC-2025-0309 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Oct 14, 2025
- ICSA-25-289-08 Siemens SINEC NMS CISA ICS & IT advisories · Oct 14, 2025
- SSA-318832 SSA-318832: SQL Injection Vulnerability in SINEC NMS Siemens ProductCERT · Oct 14, 2025