OTPulse

Siemens SINEC NMS

Plan PatchCVSS 8.8ICS-CERT ICSA-25-289-08Oct 14, 2025
Siemens
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

SINEC NMS contains a SQL injection vulnerability (CWE-89) that allows an authenticated low-privilege user to insert malicious SQL commands and escalate their privileges to administrator level. The vulnerability affects SINEC NMS versions prior to 4.0 SP1. A successful attack could allow an insider or compromised low-privilege account to gain full administrative control over the network management system and modify industrial network configuration.

What this means
What could happen
An authenticated user with low privileges could inject SQL commands into SINEC NMS to escalate their access rights and gain administrative control of the network management system, potentially enabling unauthorized changes to industrial network configuration and monitoring.
Who's at risk
Network managers and engineers at water utilities, electric utilities, and other industrial facilities using Siemens SINEC NMS for managing industrial network devices (PLCs, RTUs, switches). Anyone with engineering or operator credentials accessing SINEC NMS is at risk.
How it could be exploited
An attacker with valid SINEC NMS credentials (engineering user or operator account) can craft malicious SQL input through the application interface to bypass authorization checks and escalate privileges to administrator level, allowing modification of network settings or user accounts.
Prerequisites
  • Valid SINEC NMS user credentials (low-privilege engineering or operator account)
  • Network access to SINEC NMS application (typically internal LAN or VPN)
  • SINEC NMS version below 4.0 SP1 deployed and accessible
Remotely exploitable over networkRequires valid user credentialsLow attack complexityHigh CVSS score (8.8)Allows privilege escalation to administrative level
Exploitability
Unlikely to be exploited — EPSS score 0.0%
Affected products (1)
ProductAffected VersionsFix Status
SINEC NMS<V4.0 SP14.0 SP1
Remediation & Mitigation
0/4
Do now
0/2
HARDENINGRestrict network access to SINEC NMS application to authorized engineering workstations and administrative users only using firewall rules or VLANs
HARDENINGImplement strong access controls on SINEC NMS user accounts and audit administrative privileges regularly
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SINEC NMS to version 4.0 SP1 or later
Long-term hardening
0/1
HARDENINGSegment the network management system behind a firewall separate from business networks and ensure it is not accessible from the internet
View full CISA ICS-CERT advisory
API: /api/v1/advisories/b94abd65-ffef-40b5-b367-de6b2b967d20

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.