Description
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SINEC Security Monitor | < V4.10.0 | V4.10.0 |
Advisories 3
- ICSA-26-015-06 Siemens SINEC Security Monitor CISA ICS & IT advisories · Jan 14, 2026
- NCSC-2025-0382 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Dec 9, 2025
- SSA-882673 SSA-882673: Multiple Vulnerabilities in SINEC Security Monitor before V4.10.0 Siemens ProductCERT · Dec 9, 2025