Siemens SINEC NMS
view advisory published 2026-04-14
SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-25654US | — | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. T… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-605717: Authorization Bypass Vulnerability in SINEC NMS Before V4.0 SP3 - CSAF Versionself
- SSA-605717: Authorization Bypass Vulnerability in SINEC NMS Before V4.0 SP3 - HTML Versionself
- ICS Advisory ICSA-26-111-09 JSONself
- ICS Advisory ICSA-26-111-09 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationSINEC NMS
Limit network access to trusted users and systems only
- FixedSINEC NMS
Update to V4.0 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/110000760/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan