Multiple Vulnerabilities in SINEC NMS before V2.0 SP2

An attacker with valid credentials to SINEC NMS could modify configurations or disable network monitoring, potentially allowing undetected changes to critical network infrastructure or temporary loss of visibility into your industrial network.

Network management operators and IT personnel responsible for SINEC NMS deployments should prioritize this update. SINEC NMS is used to centrally manage Siemens industrial network equipment and switching infrastructure in utilities, manufacturing, and critical infrastructure environments.

An attacker with valid network access and login credentials to the SINEC NMS web interface could exploit these vulnerabilities to read sensitive files, bypass access controls, or execute operations that degrade system availability. The vulnerabilities involve improper error handling (CWE-754) and path traversal (CWE-22), suggesting attackers could access files outside intended directories or trigger unhandled exceptions that crash the service.