Sinec Nms (Siemens) - vulnerabilities (CVEs)

79 CVEs, 0 in the last 30 days, 15 known versions, newest CVE from 2026-04-14. Vendor: Siemens.

CVEs of Sinec Nms

CVE-2026-25654 - CVSS 8.8 (high), 2026-04-14: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing…
CVE-2026-24032 - CVSS 7.3 (high), 2026-04-14: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains an authentication weakness due to…
CVE-2026-25656 - CVSS 8.5 (high), 2026-02-10: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected…
CVE-2026-25655 - CVSS 8.5 (high), 2026-02-10: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2). The affected application permits improper modification of a configuration file by…
CVE-2025-15467 - CVSS 9.8 (critical), 2026-01-27: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact…
CVE-2025-40755 - CVSS 8.8 (high), 2025-10-14: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through…
CVE-2025-30033 - CVSS 8.5 (high), 2025-08-12: The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an…
CVE-2025-40738 - CVSS 8.8 (high), 2025-07-08: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting…
CVE-2025-40737 - CVSS 8.8 (high), 2025-07-08: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting…
CVE-2025-40736 - CVSS 9.8 (critical), 2025-07-08: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification…
CVE-2025-40735 - CVSS 8.8 (high), 2025-07-08: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL injection. This could allow an…
CVE-2025-30175 - CVSS 8.7 (high), 2025-05-13: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA…
CVE-2025-30176 - CVSS 8.7 (high), 2025-05-13: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA…
CVE-2025-30174 - CVSS 8.7 (high), 2025-05-13: A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA…
CVE-2024-49775 - CVSS 9.8 (critical), 2024-12-16: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter…
CVE-2024-47808 - CVSS 8.4 (high), 2024-11-12: A vulnerability has been identified in SINEC NMS (All versions < V3.0 SP1). The affected application contains a database function, that does not properly…
CVE-2024-33698 - CVSS 9.8 (critical), 2024-09-10: A vulnerability has been identified in Opcenter Quality (All versions < V2406), Opcenter RDnL (All versions < V2410), SIMATIC PCS neo V4.0 (All versions),…
CVE-2024-41941 - CVSS 5.3 (medium), 2024-08-13: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could…
CVE-2024-41940 - CVSS 9.4 (critical), 2024-08-13: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command…
CVE-2024-41939 - CVSS 8.8 (high), 2024-08-13: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization checks. This could…
CVE-2024-41938 - CVSS 5.5 (medium), 2024-08-13: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The importCertificate function of the SINEC NMS Control web application contains a…
CVE-2024-36398 - CVSS 8.5 (high), 2024-08-13: A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`.…
CVE-2023-46280 - CVSS 8.2 (high), 2024-05-14: A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1…
CVE-2023-6237 - CVSS 5.9 (medium), 2024-04-25: Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function…
CVE-2024-31978 - CVSS 7.6 (high), 2024-04-09: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP2). Affected devices allow authenticated users to export monitoring data. The…
CVE-2024-28182 - CVSS 5.3 (medium), 2024-04-04: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number…
CVE-2024-2379 - CVSS 6.3 (medium), 2024-03-27: libcurl skips the certificate verification for a QUIC connection under certain conditions, when built to use wolfSSL. If told to use an unknown/bad cipher or…
CVE-2024-2004 - CVSS 3.5 (low), 2024-03-27: When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to…
CVE-2024-2466 - CVSS 6.5 (medium), 2024-03-27: libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly…
CVE-2024-2398 - CVSS 8.6 (high), 2024-03-27: When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit…
CVE-2024-28757 - CVSS 7.5 (high), 2024-03-10: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2024-23812 - CVSS 8.8 (high), 2024-02-13: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elements when creating a…
CVE-2024-23811 - CVSS 8.8 (high), 2024-02-13: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This…
CVE-2024-23810 - CVSS 9.8 (critical), 2024-02-13: A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application is vulnerable to SQL injection. This could allow an…
CVE-2023-52426 - CVSS 5.5 (medium), 2024-02-04: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
CVE-2023-52425 - CVSS 7.5 (high), 2024-02-04: libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which…
CVE-2024-25062 - CVSS 7.5 (high), 2024-02-04: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion…
CVE-2024-0727 - CVSS 5.5 (medium), 2024-01-26: Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary:…
CVE-2023-6129 - CVSS 6.5 (medium), 2024-01-09: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on…
CVE-2023-46283 - CVSS 7.5 (high), 2023-12-12: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…
CVE-2023-46285 - CVSS 7.5 (high), 2023-12-12: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…
CVE-2023-46284 - CVSS 7.5 (high), 2023-12-12: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…
CVE-2023-46282 - CVSS 7.1 (high), 2023-12-12: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…
CVE-2023-46281 - CVSS 8.8 (high), 2023-12-12: A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATIC PCS neo (All…
CVE-2023-46219 - CVSS 5.3 (medium), 2023-12-12: When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the…
CVE-2023-46218 - CVSS 6.5 (medium), 2023-12-07: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible.…
CVE-2023-5678 - CVSS 5.3 (medium), 2023-11-06: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary:…
CVE-2023-5363 - CVSS 7.5 (high), 2023-10-25: Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-44315 - CVSS 5.4 (medium), 2023-10-10: A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuration data…
CVE-2022-30527 - CVSS 7.8 (high), 2023-10-10: A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing…
CVE-2023-4807 - CVSS 7.8 (high), 2023-09-08: Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the…
CVE-2023-39615 - CVSS 6.5 (medium), 2023-08-29: Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows…
CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
CVE-2022-25311 - CVSS 8.8 (high), 2022-03-08: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The…
CVE-2022-24282 - CVSS 7.2 (high), 2022-03-08: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The…
CVE-2022-24281 - CVSS 7.2 (high), 2022-03-08: A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute…
CVE-2021-42550 - CVSS 6.6 (medium), 2021-12-16: In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration…
CVE-2021-33730 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33733 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33736 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33729 - CVSS 8.8 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to…
CVE-2021-33732 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33735 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33728 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized…
CVE-2021-33731 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33734 - CVSS 7.2 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in…
CVE-2021-33727 - CVSS 6.5 (medium), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could download the user profile of any user.…
CVE-2021-33723 - CVSS 6.5 (medium), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker could change the user profile of any user…
CVE-2021-33726 - CVSS 7.5 (high), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user…
CVE-2021-33722 - CVSS 4.9 (medium), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system has a Path Traversal vulnerability when exporting a…
CVE-2021-33725 - CVSS 9.1 (critical), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under…
CVE-2021-33724 - CVSS 9.1 (critical), 2021-10-12: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system contains an Arbitrary File Deletion vulnerability…
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-39275 - CVSS 9.8 (critical), 2021-09-16: ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but…
CVE-2021-34798 - CVSS 7.5 (high), 2021-09-16: Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-37200 - CVSS 7.7 (high), 2021-09-14: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). An attacker with access to the webserver of an affected system could download…
CVE-2021-37201 - CVSS 8.8 (high), 2021-09-14: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-33721 - CVSS 7.2 (high), 2021-08-10: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating…
CVE-2021-3449 - CVSS 5.9 (medium), 2021-03-25: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits…
CVE-2020-25237 - CVSS 8.1 (high), 2021-02-09: A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files…
CVE-2020-7580 - CVSS 6.7 (medium), 2020-06-10: A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14),…
CVE-2019-6575 - CVSS 7.5 (high), 2019-04-17: A vulnerability has been identified in SIMATIC CP 443-1 OPC UA (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All…