PT-2024-3046 · Siemens · Sinec Nms

Published

2024-04-09

·

Updated

2025-09-19

·

CVE-2024-31978

CVSS v2.0

8.0

High

VectorAV:N/AC:L/Au:S/C:P/I:P/A:C
Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V2.0 SP2
Description A vulnerability has been identified that allows authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal, which could allow an authenticated attacker to download files from the file system. In certain circumstances, the downloaded files are deleted from the file system. The issue is related to incorrect restriction of directory path names with limited access. Exploitation of the vulnerability may allow a remote attacker to export monitoring data and upload files from the file system using a specially crafted HTTP request.
Recommendations For versions prior to V2.0 SP2, update to V2.0 SP2 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint susceptible to path traversal to minimize the risk of exploitation. Avoid using the vulnerable API endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-03230
CVE-2024-31978

Affected Products

Sinec Nms