NMS Vulnerability Allows Local Attacker to Execute OS Commands with Elevated Privileges

CVE-2024-36398

Summary

A vulnerability has been discovered in the SINEC Network Management System (NMS), affecting all versions prior to V3.0. The issue arises from the application's execution of certain services with 'NT AUTHORITY\SYSTEM' privileges. This design flaw allows local attackers to potentially execute operating system commands, resulting in elevated privileges and unauthorized access to critical system functionalities. Addressing this vulnerability is essential to protect system integrity and prevent exploitation.

References