EUVD-2026-22233
GHSA-7f3f-wq83-6q76
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionNVD
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)
AnalysisAI
Authentication bypass in Siemens SINEC NMS versions prior to V4.0 SP3 with UMC allows unauthenticated remote attackers to gain unauthorized access due to insufficient user identity validation in the UMC component (CWE-347: Improper Verification of Cryptographic Signature). The vulnerability enables network-based attacks with low complexity requiring no user interaction (CVSS 7.3, AV:N/AC:L/PR:N/UI:N), granting partial access to confidentiality, integrity, and availability. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify and document all Siemens SINEC NMS installations with versions prior to V4.0 SP3, particularly those with UMC enabled and internet-facing access. Within 7 days: Implement network segmentation to restrict remote access to SINEC NMS systems to authorized management networks only; deploy enhanced monitoring on SINEC NMS authentication logs for anomalous access patterns. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today