Siemens SINEC NMS

An attacker could gain administrative control of your SINEC NMS system, allowing them to modify network management settings, access sensitive network configuration data, or execute commands that could affect how your industrial network is monitored and controlled.

This affects water utilities and electric utilities that use Siemens SINEC NMS for network management and monitoring of industrial control systems. Network administrators responsible for ICS visibility and management should prioritize this update, as SINEC NMS is typically a critical access point for managing industrial devices across your network.

An attacker on the network can send malicious requests to the SINEC NMS system without credentials. The SQL injection vulnerability allows database manipulation, the missing authentication checks allow unauthorized access, and the path traversal allows access to protected files. Combined, these could lead to administrative privilege escalation and arbitrary code execution on the NMS system.