CVE-2022-24281
mediumPriorität · verfolgen · 27EPSS 0.035 · 89. PerzentilDEEUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSINEC NMSsiemens_psirt
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - BehobenSINEC NMScisa_csaf_ot
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/ - MitigationSINEC NMSsiemens_psirt
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Server V14siemens_psirt
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEC NMScisa_csaf_ot
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- MitigationSINEMA Server V14cisa_csaf_ot
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
- Kein Fix geplantSINEMA Server V14siemens_psirt
Currently no fix is planned
- Kein Fix geplantSINEMA Server V14cisa_csaf_ot
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.5–7.2
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (9)
Betroffene Produkte und Versionsbereiche.
- siemens sinec network management system< 1.0.3nvdUScpe:2.3:a:siemens:sinec_network_management_system:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-250085SSA-250085: Multiple Vulnerabilities in SINEC NMS and SINEMA Server2022-03-08csaf · siemens_psirtDE
SINEC NMS and SINEMA Server V14 contain multiple vulnerabilities that could allow an attacker to execute arbitrary code on the system, arbitrary commands on the local database or achieve privilege escalation. Siemens has released several updates for SINEC NMS and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
- ICSA-22-069-03Siemens SINEC NMS2022-03-08icsa · cisa_csaf_otUS
SINEC NMS and SINEMA Server V14 contain multiple vulnerabilities that could allow an attacker to execute arbitrary code on the system, arbitrary commands on the local database or achieve privilege escalation. Siemens has released several updates for SINEC NMS and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdfcnnvd
- https://cxsecurity.com/cveshow/CVE-2022-24281/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-069-03cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.1043cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022031006cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdfMitigationVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan