PT-2025-28396 · Sinec Nms · Sinec Nms

Published 2025-07-08 · Updated 2025-07-09 · CVE-2025-40738

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V4.0

Description: A security issue has been identified in the affected application, where it does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges.

Recommendations: For versions prior to V4.0, update to version V4.0 or later to resolve the issue. As a temporary workaround, consider restricting the upload of ZIP files or implementing additional validation on file paths to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-08985

CVE-2025-40738

ZDI-25-576

Affected Products

Sinec Nms

References · 9

• https://cert-portal.siemens.com/productcert/html/ssa-078892.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40738 · Security Note
• https://bdu.fstec.ru/vul/2025-08985 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40738 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-576 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-26572 · Note
• https://twitter.com/CVEnew/status/1942535941593391247 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1943061108597600657 · Twitter Post
• https://twitter.com/CveFindCom/status/1942541590901277072 · Twitter Post