PT-2021-20298 · Siemens · Sinec Nms

CVE-2021-33723 · Published 2021-10-12 · Updated 2022-10-27

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V1.0 SP2 Update 1

Description: A vulnerability has been identified that allows an authenticated attacker to change the user profile of any user without proper authorization, potentially enabling them to change the password of any user in the affected system.

Recommendations: For versions prior to V1.0 SP2 Update 1, update to V1.0 SP2 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to user profile management functions to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2021-33723

Affected Products

Sinec Nms

References · 6

• https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33723 · Security Note
• https://t.me/cibsecurity/30379 · Telegram Post
• https://t.me/true_secator/3077 · Telegram Post
• https://t.me/poxek/1876 · Telegram Post