Insecure Deserialization Vulnerability in SINEC NMS and SINEMA Server

CVE-2022-24282

What is CVE-2022-24282?

A vulnerability exists in the SINEC NMS and SINEMA Server that allows unauthorized users to upload malicious JSON objects. This insecure deserialization could enable an attacker to send a specially crafted serialized Java object, leading to arbitrary code execution with root privileges on affected devices. It’s critical for users to assess their implementations and update to mitigate the risk of exploitation.

References