CVE-2026-25656

Katalog CVE

CVSS 7.8 · High EPSS 0,20%

Kerentanan Uncontrolled Search Path Element pada siemens sinec nms, siemens user management component. Skor CVSS 3.1 7.8 (High) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All versions < V2.15.2.1). The affected application permits improper modification of a configuration file by a low-privileged user. This could allow an attacker to load malicious DLLs, potentially leading to arbitrary code execution with SYSTEM privileges.(ZDI-CAN-28108)

Rincian

Terbit di NVD

10 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber siemens.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cert-portal.siemens.com/productcert/html/ssa-311973.html advisory vendor