High severity · published Mar 8, 2022
CVE-2022-25311
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions)
7.3
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
Sinec Network Management System · Siemens
before 1.0.3 · source: NVD
SS
Sinema Server · Siemens
14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25311
Mitigation
https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf
More from Sinec Network Management System
9.8
CVE-2022-22965
Spring Framework JDK 9+ Remote Code Execution Vulnerability
8.8
CVE-2021-37201
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1)
8.1
CVE-2020-25237
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2)
7.7
CVE-2021-37200
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1)
7.2
CVE-2022-24282
A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions)