What is CVE-2022-25311?

CVE-2022-25311 is a high-severity vulnerability in Siemens Sinec Network Management System, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2022-03-08.

How severe is CVE-2022-25311?

High severity. CVSS v3 base score is 7.3 out of 10.

Privilege escalation in Siemens Sinec Network Management System

CVE-2022-25311

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

Vulnerability class: Privilege Escalation

EPSS: 0.005 (43.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Siemens Sinec_network_management_system
Siemens Sinec Nms — versions All versions >= V1.0.3 < V2.0, All versions < V1.0.3
Siemens Sinema_server — versions 14.0
Siemens Sinema Server V14 — versions All versions

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

productcert@siemens.com (Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2022-25311?: CVE-2022-25311 is a high-severity vulnerability in Siemens Sinec Network Management System, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2022-03-08.
How severe is CVE-2022-25311?: High severity. CVSS v3 base score is 7.3 out of 10.