OTPulse
FeedAboutContact

Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0

Plan Patch7.8SSA-517338Aug 12, 2025
Attack VectorLocal
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

SINEC Traffic Analyzer before version 3.0 is affected by multiple vulnerabilities including use-after-free (CWE-416), null pointer dereference (CWE-476), unrestricted resource consumption (CWE-400), missing privilege checks (CWE-250), and information disclosure (CWE-200). These flaws allow a local attacker with limited privileges to execute arbitrary code, cause denial of service, or access sensitive information on affected systems.

What this means
What could happen
An attacker with local access and limited user privileges could execute arbitrary code on the Traffic Analyzer, potentially disrupting network monitoring and visibility of transportation infrastructure operations, or reading sensitive network traffic data and configuration files.
Who's at risk
Transportation network operators and infrastructure managers who deploy SINEC Traffic Analyzer for network monitoring and traffic analysis. This affects organizations using Siemens traffic management and monitoring systems in road, rail, and transit environments.
How it could be exploited
An attacker with local access to the Traffic Analyzer system could exploit use-after-free or null pointer dereference flaws in the application to trigger a crash (denial of service) or, with additional manipulation, execute arbitrary code with elevated privileges. The low complexity and privilege requirements make this exploitable by internal users or compromised accounts.
Prerequisites
  • Local access to the Traffic Analyzer system
  • Low-privilege user account on the system
  • Ability to interact with the affected application or its network services
Low-complexity exploitationAffects network monitoring systemsLocal privilege escalation pathInformation disclosure capabilityDenial of service capability
Exploitability
Low exploit probability (EPSS 0.7%)
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
SINEC Traffic AnalyzerAll versions3.0
SINEC Traffic Analyzer< 3.03.0
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

SINEC Traffic Analyzer
HOTFIXUpdate SINEC Traffic Analyzer to version 3.0 or later
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/21018ae6-e414-4a91-93c1-8a89e3bd1292
Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0 | CVSS 7.8 - OTPulse