PT-2025-41881 · Siemens · Sinec Nms

Published 2025-10-14 · Updated 2025-11-25 · CVE-2025-40755

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SINEC NMS versions prior to 4.0 SP1

Description A SQL injection flaw exists in SINEC NMS through the getTotalAndFilterCounts API endpoint. An authenticated attacker with low privileges can exploit this issue to insert data, manipulate data, gain unauthorized access, and escalate privileges. The vulnerability occurs because the getTotalAndFilterCounts endpoint does not adequately sanitize user-supplied input before processing it, allowing for the execution of arbitrary SQL commands.

Recommendations Versions prior to 4.0 SP1 should be updated to version 4.0 SP1 or later.

Fix

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-40755

ZDI-25-1021

Affected Products

Sinec Nms

References · 10

• https://zerodayinitiative.com/advisories/ZDI-25-1021 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40755 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-318832.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40755 · Security Note
• https://t.me/CVEtracker/34847 · Telegram Post
• https://twitter.com/TheZDIBugs/status/1993438188090609724 · Twitter Post
• https://twitter.com/CveTodo/status/1978045630841762200 · Twitter Post
• https://twitter.com/CveFindCom/status/1978032974382641485 · Twitter Post
• https://twitter.com/CVEnew/status/1978032049643458895 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978077122703876155 · Twitter Post