High severity · published Aug 10, 2021
CVE-2021-33721
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2)
7.2
CVSS
2.7%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to command injection. An authenticated remote attacker with administrative privileges could exploit this vulnerability to execute arbitrary code on the system with system privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Sinec Network Management System · Siemens
before 1.0; 1.0; 1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33721
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33721
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-756744.pdf
More from Sinec Network Management System
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
8.8
CVE-2021-37201
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1)
8.1
CVE-2020-25237
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2)
7.7
CVE-2021-37200
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1)
7.3
CVE-2022-25311
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions)