PT-2025-28395 · Sinec Nms · Sinec Nms

Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-40737

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V4.0

Description: A vulnerability has been identified in the affected application where it does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges.

Recommendations: For versions prior to V4.0, update to version V4.0 or later to resolve the issue. As a temporary workaround, consider restricting the upload of ZIP files or implementing additional validation on file paths to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-08984

CVE-2025-40737

ZDI-25-575

Affected Products

Sinec Nms

References · 8

• https://osv.dev/vulnerability/CVE-2025-40737 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-078892.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-575 · Security Note
• https://bdu.fstec.ru/vul/2025-08984 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-40737 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-26571 · Note
• https://twitter.com/CveFindCom/status/1942541657674596718 · Twitter Post
• https://twitter.com/CVEnew/status/1942535942474174926 · Twitter Post