Arbitrary File Upload Vulnerability in SINEC NMS Could Lead to Remote Code Execution
CVE-2024-23811

8.8HIGH

Key Information:

Vendor
Siemens
Status
Sinec Nms
Vendor
CVE Published:
13 February 2024

Summary

A security vulnerability in SINEC NMS allows for arbitrary file uploads via TFTP to versions prior to V2.0 SP1. This flaw provides an opportunity for attackers to upload malicious files, including firmware images, potentially enabling remote code execution on affected systems. Users are urged to take immediate precautions to mitigate risks associated with this vulnerability.

Affected Version(s)

SINEC NMS 0

References

https://cert-portal.siemens.com/productcert/html/ssa-9439...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.