PT-2021-21573 · Siemens · Sinec Nms

Published 2021-09-14 · Updated 2021-09-24 · CVE-2021-37201

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V1.0 SP1

Description A Cross-Site Request Forgery (CSRF) attack can be performed on the web interface of affected devices. This could allow an attacker to manipulate the SINEC NMS configuration by tricking an unsuspecting user with administrative privileges to click on a malicious link.

Recommendations For versions prior to V1.0 SP1, update to V1.0 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-37201

Affected Products

Sinec Nms

References · 4

• https://osv.dev/vulnerability/CVE-2021-37201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37201 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-330339.pdf · Vendor Advisory
• https://t.me/cibsecurity/28771 · Telegram Post