Description
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).
Published: 2025-07-08
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-20433 A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).
History

Thu, 21 Aug 2025 17:15:00 +0200

Type Values Removed Values Added
First Time appeared Siemens sinec Nms
CPEs cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
Vendors & Products Siemens sinec Nms

Mon, 14 Jul 2025 15:45:00 +0200

Type Values Removed Values Added
Metrics epss

{'score': 0.00074}

 epss

{'score': 0.00097}

Tue, 08 Jul 2025 18:15:00 +0200

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 08 Jul 2025 12:45:00 +0200

Type Values Removed Values Added
Description A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Siemens Sinec-nms Sinec Nms
cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2025-07-08T16:11:31.654Z

Reserved: 2025-04-16T08:39:30.028Z

Link: CVE-2025-40736

cve-icon Vulnrichment

Updated: 2025-07-08T14:25:40.957Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-08T11:15:29.837

Modified: 2026-06-17T09:22:03.030

Link: CVE-2025-40736

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-13T23:47:09Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function