CVE-2026-25654

HIGH

Siemens SINEC NMS <V4.0 SP3 - Auth Bypass

Title source: llm

Description

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.

References (1)

https://cert-portal.siemens.com/productcert/html/ssa-605717.html

Scores

CVSS v3 8.8

EPSS 0.0005

EPSS Percentile 15.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-639

Status published

Products (1)

Siemens/SINEC NMS < V4.0 SP3

Published Apr 14, 2026

Tracked Since Apr 14, 2026