Privilege escalation in Siemens Sinec Network Management System
CVE-2022-25311
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.
Vulnerability class: Privilege Escalation
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.005 (45.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Siemens Sinec Network Management System
- Siemens Sinec Nms — versions All versions >= V1.0.3 < V2.0, All versions < V1.0.3
- Siemens Sinema Server — versions 14.0
- Siemens Sinema Server V14 — versions All versions
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-25311?
- CVE-2022-25311 is a high-severity vulnerability in Siemens Sinec Network Management System, classified under Improper Privilege Management. CVSS score: 7.3/10. Published 2022-03-08.
- How severe is CVE-2022-25311?
- High severity. CVSS v3 base score is 7.3 out of 10.