Sinec Nms CVE-2026-25654

Attacker must be an authenticated remote user with valid credentials to SINEC NMS versions below V4.0 SP3. No victim interaction required. Allows password reset of arbitrary user accounts through authorization bypass in password reset functionality.

Real-world risk is elevated for organizations using affected SINEC NMS deployments. The CVSS 8.8 score reflects high impact across all security dimensions (C:H/I:H/A:H) with network accessibility and low attack complexity. While authentication is required (PR:L), industrial networks often have service accounts or default credentials that lower this barrier. No EPSS data, KEV listing, or public POC was provided in available intelligence, suggesting exploitation is not yet widespread or automated. However, the CVSS vector's AC:L designation indicates exploitation is straightforward once authenticated access is achieved. The unchanged scope (S:U) means the vulnerability cannot pivot beyond the SINEC NMS system itself, but complete control of a network management platform in OT environments poses significant operational risk. Organizations with internet-exposed SINEC NMS instances or internal threat concerns should prioritize remediation, while air-gapped environments face lower immediate risk. The authentication requirement prevents opportunistic scanning-based exploitation, but insider threats or credential compromise scenarios make this a viable attack path.

An attacker gains initial authenticated access to SINEC NMS through compromised low-privilege credentials (obtained via phishing, credential stuffing, or default account exploitation). The attacker crafts password reset requests manipulating user identifiers or account references without proper authorization checks, successfully resetting the administrator account password. With administrative credentials, the attacker achieves full control over the industrial network management system, enabling manipulation of network configurations, disruption of monitoring capabilities, or pivoting to managed SCALANCE devices.