Siemens Sinec Network Management System vulnerabilities

9 CVEs affecting Siemens Sinec Network Management System, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22965, published 2022-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability, published 2022-04-01. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-04. EPSS: 99.6% chance of exploitation in the next 30 days. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR…
CVE-2021-37200, published 2021-09-14. High severity, CVSS 7.7. EPSS: 37.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the underlying…
CVE-2020-25237, published 2021-02-09. High severity, CVSS 8.1. EPSS: 20.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip…
CVE-2022-24281, published 2022-03-08. High severity, CVSS 7.2. EPSS: 3.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database…
CVE-2021-33721, published 2021-08-10. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to…
CVE-2022-24282, published 2022-03-08. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON…
CVE-2022-25311, published 2022-03-08. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check…
CVE-2020-7580, published 2020-06-10. Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions),…
CVE-2021-37201, published 2021-09-14. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This could allow an…