Sinec Nms EUVD-2026-22233

Real-world risk is HIGH despite moderate CVSS 7.3 score. The CVSS vector reveals optimal attacker conditions: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). While impact ratings are partial (C:L/I:L/A:L), authentication bypass in industrial network management systems provides attackers a foothold for lateral movement, reconnaissance of OT infrastructure, and potential manipulation of network configurations. EPSS data not provided, but similar authentication bypass vulnerabilities in ICS/SCADA contexts historically show elevated exploitation interest. No CISA KEV listing indicates no confirmed active exploitation campaigns at present. The JWT-specific nature (per tags) means exploit development is straightforward for experienced attackers familiar with common JWT vulnerabilities. Priority should be elevated for organizations running SINEC NMS in production OT environments, particularly those with internet-exposed or cross-network accessible management interfaces. The SSVC framework would likely classify this as high technical impact with automatable exploitation given the authentication bypass nature.

An unauthenticated remote attacker identifies a SINEC NMS V3.x installation accessible via corporate network or internet exposure. The attacker crafts malicious JWT tokens exploiting signature validation weaknesses in the UMC component, such as submitting unsigned tokens or manipulating the algorithm header to bypass cryptographic verification. Upon successful authentication bypass, the attacker gains unauthorized access to the SINEC NMS interface with legitimate user privileges, enabling reconnaissance of managed industrial network topology, extraction of device configurations and credentials, manipulation of network policies, or establishment of persistent access for subsequent operational technology environment compromise.