PT-2025-28394 · Sinec Nms · Sinec Nms

Published 2025-07-08 · Updated 2025-07-09 · CVE-2025-40736

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V4.0

Description: A vulnerability has been identified in the affected application, which exposes an endpoint that allows unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application.

Recommendations: For versions prior to V4.0, update to version V4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the exposed endpoint to minimize the risk of exploitation. Avoid using the affected application until the issue is resolved.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-08268

CVE-2025-40736

ZDI-25-574

Affected Products

Sinec Nms

References · 9

• https://osv.dev/vulnerability/CVE-2025-40736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40736 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-574 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-078892.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08268 · Security Note
• https://twitter.com/CVEnew/status/1942535943329841508 · Twitter Post
• https://twitter.com/CveFindCom/status/1942541712221507769 · Twitter Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-078892.pdf · Note
• https://twitter.com/the_yellow_fall/status/1942774064634028126 · Twitter Post