PT-2026-32608 · Siemens · Sinec Nms

Published 2026-04-14 · Updated 2026-04-30 · CVE-2026-25654

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V4.0 SP3

Description An issue exists where user authorization is not properly validated during the processing of password reset requests. This allows an authenticated remote attacker to bypass authorization checks and reset the password of any arbitrary user account.

Recommendations Update to V4.0 SP3.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-25654

ZDI-26-297

Affected Products

Sinec Nms

References · 7

• https://zerodayinitiative.com/advisories/ZDI-26-297 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25654 · Security Note
• https://twitter.com/VulmonFeeds/status/2044041902022930473 · Twitter Post
• https://twitter.com/CveFindCom/status/2043988497212518687 · Twitter Post
• https://twitter.com/ptdbugs/status/2044000686535270689 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2049937523242160573 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-605717.html · Note