PT-2025-49839 · Siemens · Sinec Security Monitor

Published 2025-12-09 · Updated 2025-12-09 · CVE-2025-40830

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINEC Security Monitor versions prior to 4.10.0

Description The application lacks appropriate authorization controls for the file transfer feature within the ssmctl-client command. This could enable an authenticated, low-privilege local attacker to read or write any file on the server or sensor.

Recommendations Update to version 4.10.0 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2025-15617

CVE-2025-40830

Affected Products

Sinec Security Monitor

References · 5

• https://osv.dev/vulnerability/CVE-2025-40830 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-882673.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40830 · Security Note
• https://bdu.fstec.ru/vul/2025-15617 · Security Note
• https://twitter.com/CVEnew/status/1998355322029908185 · Twitter Post