ID
VAR-202507-0069
CVE
CVE-2025-40737
TITLE
Siemens' SINEC NMS Past traversal vulnerability in
Trust: 0.8
DESCRIPTION
A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26571). Siemens' SINEC NMS Exists in a past traversal vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the unZipJarFilestoLocation method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Siemens SINEC NMS is a network management system (NMS) of Siemens, Germany. The system can be used to centrally monitor, manage and configure industrial networks with tens of thousands of devices around the clock, including security-related areas. Siemens SINEC NMS has a path traversal vulnerability. Attackers can exploit this vulnerability to cause arbitrary file writes
Trust: 2.79
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | sinec nms | scope: | lt | version: | 4.0 | Trust: 1.0 |
| vendor: | シーメンス | model: | sinec nms | scope: | eq | version: | 4.0 | Trust: 0.8 |
| vendor: | シーメンス | model: | sinec nms | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | sinec nms | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | siemens | model: | sinec nms | scope: | - | version: | - | Trust: 0.7 |
| vendor: | siemens | model: | sinec nms | scope: | lt | version: | v4.0 | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-22 | Trust: 1.0 |
| problemtype: | Path traversal (CWE-22) [ others ] | Trust: 0.8 |
PATCH
| title: | Siemens has issued an update to correct this vulnerability. | url: | https://cert-portal.siemens.com/productcert/html/ssa-078892.html | Trust: 0.7 |
| title: | Patch for Siemens SINEC NMS Path Traversal Vulnerability (CNVD-2025-16629) | url: | https://www.cnvd.org.cn/patchInfo/show/711166 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2025-40737 | Trust: 3.9 |
| db: | SIEMENS | id: | SSA-078892 | Trust: 2.4 |
| db: | JVN | id: | JVNVU99667406 | Trust: 0.8 |
| db: | ICS CERT | id: | ICSA-25-191-01 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2025-012080 | Trust: 0.8 |
| db: | ZDI_CAN | id: | ZDI-CAN-26571 | Trust: 0.7 |
| db: | ZDI | id: | ZDI-25-575 | Trust: 0.7 |
| db: | CNVD | id: | CNVD-2025-16629 | Trust: 0.6 |
REFERENCES
| url: | https://cert-portal.siemens.com/productcert/html/ssa-078892.html | Trust: 3.1 |
| url: | https://jvn.jp/vu/jvnvu99667406/ | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2025-40737 | Trust: 0.8 |
| url: | https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-01 | Trust: 0.8 |
CREDITS
Anonymous
Trust: 0.7
SOURCES
| db: | ZDI | id: | ZDI-25-575 |
| db: | CNVD | id: | CNVD-2025-16629 |
| db: | JVNDB | id: | JVNDB-2025-012080 |
| db: | NVD | id: | CVE-2025-40737 |
LAST UPDATE DATE
2025-08-23T23:07:00.329000+00:00
SOURCES UPDATE DATE
| db: | ZDI | id: | ZDI-25-575 | date: | 2025-07-08T00:00:00 |
| db: | CNVD | id: | CNVD-2025-16629 | date: | 2025-07-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-012080 | date: | 2025-08-22T06:01:00 |
| db: | NVD | id: | CVE-2025-40737 | date: | 2025-08-21T15:10:38.123 |
SOURCES RELEASE DATE
| db: | ZDI | id: | ZDI-25-575 | date: | 2025-07-08T00:00:00 |
| db: | CNVD | id: | CNVD-2025-16629 | date: | 2025-07-22T00:00:00 |
| db: | JVNDB | id: | JVNDB-2025-012080 | date: | 2025-08-22T00:00:00 |
| db: | NVD | id: | CVE-2025-40737 | date: | 2025-07-08T11:15:30.007 |