PT-2024-1878 · Siemens · Sinec Nms

Published 2024-02-13 · Updated 2024-10-04 · CVE-2024-23810

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V2.0 SP1

Description A vulnerability has been identified in the affected application, making it susceptible to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database. The issue is related to the lack of protection for the SQL query structure, which can be exploited by a remote attacker to perform unauthorized actions on the server database.

Recommendations For versions prior to V2.0 SP1, update to V2.0 SP1 or later to resolve the issue. As a temporary workaround, consider restricting access to the SQL database to minimize the risk of exploitation. Avoid using user-input data in SQL queries until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-01643

CVE-2024-23810

Affected Products

Sinec Nms

References · 6

• https://osv.dev/vulnerability/CVE-2024-23810 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-943925.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23810 · Security Note
• https://bdu.fstec.ru/vul/2024-01643 · Security Note
• https://twitter.com/VulmonFeeds/status/1757372616786989443 · Twitter Post
• https://twitter.com/CVEnew/status/1757332546835095950 · Twitter Post