[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxePyOWhOOfLsWwGpRztuRlust2FVk9kaYUqtpIVLC8I":3,"g5a-family:siemens\u002Fsinec_network_management_system":106,"g5a-ex:siemens\u002Fsinec_network_management_system@*":107},{"success":4,"data":5},true,{"product":6,"versions":22,"topVulnerabilitiesByEpss":25,"kevVulnerabilities":78,"seoMetadata":84,"meta":103},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":21},"siemens","sinec_network_management_system",2,9,1,"2022-04-01",[14,19],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"1.0",4,0,false,{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},"1.0.3","Sinec Network Management System by Siemens is a technology product with 2 tracked versions and 9 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[23,24],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},[26,33,40,46,52,57,61,66,73],{"cveId":27,"description":28,"publishedDate":12,"cvssScore":29,"cvssVersion":30,"severity":31,"isKev":4,"epssScore":32},"CVE-2022-22965","A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",9.8,"v3.1","Critical",0.99638,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":39},"CVE-2021-37200","A vulnerability has been identified in SINEC NMS (All versions \u003C V1.0 SP1). An attacker with access to the webserver of an affected system could download arbitrary files from the underlying filesystem by sending a specially crafted HTTP request.","2021-09-14",7.7,"High",0.3738,{"cveId":41,"description":42,"publishedDate":43,"cvssScore":44,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":45},"CVE-2020-25237","A vulnerability has been identified in SINEC NMS (All versions \u003C V1.0 SP1 Update 1), SINEMA Server (All versions \u003C V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)","2021-02-09",8.1,0.20616,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":50,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":51},"CVE-2022-24281","A vulnerability has been identified in SINEC NMS (All versions \u003C V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application.","2022-03-08",7.2,0.03489,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":50,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":56},"CVE-2021-33721","A vulnerability has been identified in SINEC NMS (All versions \u003C V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to command injection. An authenticated remote attacker with administrative privileges could exploit this vulnerability to execute arbitrary code on the system with system privileges.","2021-08-10",0.02672,{"cveId":58,"description":59,"publishedDate":49,"cvssScore":50,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":60},"CVE-2022-24282","A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 \u003C V2.0), SINEC NMS (All versions \u003C V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.",0.0143,{"cveId":62,"description":63,"publishedDate":49,"cvssScore":64,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":65},"CVE-2022-25311","A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 \u003C V2.0), SINEC NMS (All versions \u003C V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.",7.3,0.00537,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":30,"severity":71,"isKev":18,"epssScore":72},"CVE-2020-7580","A vulnerability has been identified in SIMATIC Automation Tool (All versions \u003C V4 SP2), SIMATIC NET PC Software V14 (All versions \u003C V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions), SIMATIC NET PC Software V16 (All versions \u003C V16 Upd3), SIMATIC PCS neo (All versions \u003C V3.0 SP1), SIMATIC ProSave (All versions \u003C V17), SIMATIC S7-1500 Software Controller (All versions \u003C V21.8), SIMATIC STEP 7 (TIA Portal) V13 (All versions \u003C V13 SP2 Update 4), SIMATIC STEP 7 (TIA Portal) V14 (All versions \u003C V14 SP1 Update 10), SIMATIC STEP 7 (TIA Portal) V15 (All versions \u003C V15.1 Update 5), SIMATIC STEP 7 (TIA Portal) V16 (All versions \u003C V16 Update 2), SIMATIC STEP 7 V5 (All versions \u003C V5.6 SP2 HF3), SIMATIC WinCC OA V3.16 (All versions \u003C V3.16 P018), SIMATIC WinCC OA V3.17 (All versions \u003C V3.17 P003), SIMATIC WinCC Runtime Advanced (All versions \u003C V16 Update 2), SIMATIC WinCC Runtime Professional V13 (All versions \u003C V13 SP2 Update 4), SIMATIC WinCC Runtime Professional V14 (All versions \u003C V14 SP1 Update 10), SIMATIC WinCC Runtime Professional V15 (All versions \u003C V15.1 Update 5), SIMATIC WinCC Runtime Professional V16 (All versions \u003C V16 Update 2), SIMATIC WinCC V7.4 (All versions \u003C V7.4 SP1 Update 14), SIMATIC WinCC V7.5 (All versions \u003C V7.5 SP1 Update 3), SINAMICS STARTER (All Versions \u003C V5.4 HF2), SINAMICS Startdrive (All Versions \u003C V16 Update 3), SINEC NMS (All versions \u003C V1.0 SP2), SINEMA Server (All versions \u003C V14 SP3), SINUMERIK ONE virtual (All Versions \u003C V6.14), SINUMERIK Operate (All Versions \u003C V6.14). A common component used by the affected applications regularly calls a helper binary with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to execute arbitrary code with SYTEM privileges.","2020-06-10",6.7,"Medium",0.0046,{"cveId":74,"description":75,"publishedDate":36,"cvssScore":76,"cvssVersion":30,"severity":38,"isKev":18,"epssScore":77},"CVE-2021-37201","A vulnerability has been identified in SINEC NMS (All versions \u003C V1.0 SP1). The web interface of affected devices is vulnerable to a Cross-Site Request Forgery (CSRF) attack. This could allow an attacker to manipulate the SINEC NMS configuration by tricking an unsuspecting user with administrative privileges to click on a malicious link.",8.8,0.00429,[79],{"cveId":27,"description":28,"publishedDate":12,"cvssScore":29,"severity":31,"isKev":4,"epssScore":32,"cisaVulnName":80,"cisaDateAdded":81,"cisaShortDescription":82,"cisaRequiredAction":83},"Spring Framework JDK 9+ Remote Code Execution Vulnerability","2022-04-04","Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.","Apply updates per vendor instructions.",{"title":85,"metaDescription":86,"keywords":87,"structuredData":88},"Sinec Network Management System by Siemens - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Sinec Network Management System by Siemens covering 2 versions with 9 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Sinec Network Management System vulnerabilities, Sinec Network Management System security, Sinec Network Management System CVE, Siemens Sinec Network Management System, Sinec Network Management System threat intelligence, Siemens security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Sinec Network Management System KEV, Sinec Network Management System exploited vulnerabilities",{"@context":89,"@type":90,"name":91,"description":86,"url":92,"manufacturer":93,"applicationCategory":97,"softwareVersion":98,"mainEntity":99},"https:\u002F\u002Fschema.org","SoftwareApplication","Sinec Network Management System","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fsiemens\u002Fsinec_network_management_system",{"@type":94,"name":95,"url":96},"Organization","Siemens","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fsiemens","Security Software","2 versions tracked",{"@type":100,"name":101,"description":102,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Sinec Network Management System Security Vulnerabilities","Security vulnerabilities affecting Sinec Network Management System by Siemens",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":104,"apiVersion":105},"2026-10-18T15:54:44.594Z","3.0",[],{"rows":108,"total":11,"capped":18,"failed":17},[109],{"cveId":27,"name":80,"severity":31,"cvss":29,"added":81,"epss":32,"published":110,"ranges":111,"checked":4,"hits":113,"covers":18},"2022-04-01T23:15:13.87",[112],"before 1.0.3",[]]