Siemens SINEC NMS
view advisory published 2021-09-14
A recent update for SINEC NMS fixed multiple vulnerabilities. The most severe of these vulnerabilities could allow an attacker to manipulate the SINEC NMS configuration by tricking an admin to click on a malicious link. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-37201US | high8.8 | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This… | ||||
| CVE-2021-37200US | high7.7 | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the u… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-330339: Web Vulnerabilities in SINEC NMS - CSAF Versionself
- SSA-330339: Web Vulnerabilities in SINEC NMS - PDF Versionself
- SSA-330339: Web Vulnerabilities in SINEC NMS - TXT Versionself
- ICS Advisory ICSA-21-257-14 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-257-14 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (4)
- FixedSINEC NMS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776939/ - FixedSINEC NMS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776939/ - WorkaroundSINEC NMS
Do not access links from untrusted sources
- WorkaroundSINEC NMS
Do not access links from untrusted sources
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan