PT-2021-20296 · Siemens · Sinec Nms

Published 2021-08-10 · Updated 2021-08-17 · CVE-2021-33721

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2

Description: A vulnerability has been identified in the application where it incorrectly neutralizes special elements when creating batch operations, leading to command injection. An authenticated remote attacker with administrative privileges could exploit this issue to execute arbitrary code on the system with system privileges.

Recommendations: For versions prior to V1.0 SP2, update to V1.0 SP2 or later to resolve the issue. As a temporary workaround, consider restricting administrative access to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-33721

Affected Products

Sinec Nms

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-756744.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33721 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33721 · Vendor Advisory
• https://t.me/cibsecurity/27047 · Telegram Post