Arbitrary Command Execution in SINEC NMS and SINEMA Server by Siemens

CVE-2022-24281

What is CVE-2022-24281?

A vulnerability exists in SINEC NMS and SINEMA Server that allows a privileged authenticated attacker to execute arbitrary commands on the local database. This issue arises from the improper handling of specially crafted requests sent to the webserver of these applications. If exploited, this vulnerability could lead to significant security breaches, compromising the integrity and confidentiality of the affected systems.

References