SSA-330339: Web Vulnerabilities in SINEC NMS
A recent update for SINEC NMS fixed multiple vulnerabilities. The most severe of these vulnerabilities could allow an attacker to manipulate the SINEC NMS configuration by tricking an admin to click on a malicious link. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-37201US | high8.8 | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This… | ||||
| CVE-2021-37200US | high7.7 | — | ||
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the u… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (4)
- BehobenSINEC NMS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776939/ - BehobenSINEC NMS
Update to V1.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109776939/ - WorkaroundSINEC NMS
Do not access links from untrusted sources
- WorkaroundSINEC NMS
Do not access links from untrusted sources
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan