Critical Flaws Found in Siemens SINEC NMS: Privilege Escalation and Remote Code Execution Risks

iemens has released a critical security advisory detailing multiple high-severity vulnerabilities affecting SINEC NMS, its flagship network management system for industrial environments. The flaws impact all versions of SINEC NMS prior to version 4.0, and if exploited, could allow attackers to gain administrative access, execute arbitrary code, or escalate privileges within critical infrastructure networks.

“Siemens SINEC NMS before V4.0 is affected by multiple vulnerabilities which could allow an attacker to elevate privilege and exceute arbitrary code,” the advisory warns.

With a CVSS v3.1 base score as high as 9.8, these vulnerabilities are considered critical, particularly in operational technology (OT) environments where SINEC NMS is commonly deployed to monitor and manage industrial networks.

SINEC NMS is Siemens’ network management platform for the Digital Enterprise, enabling centralized configuration, monitoring, and management of industrial networks. It is widely used in manufacturing, energy, and infrastructure sectors—making it a high-value target for attackers seeking to disrupt or gain foothold in OT environments.

CVE-2025-40736 – Missing Authentication for Critical Function

This is the most severe flaw, with a CVSS v3.1 score of 9.8. The application exposes an endpoint that allows unauthorized modification of administrative credentials. An attacker can reset the superadmin password and take full control of the NMS system.

“This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application,” Siemens disclosed.

This vulnerability, tracked by ZDI-CAN-26569, represents a direct path to full compromise without any user interaction.

CVE-2025-40735 – SQL Injection

A classic and dangerous web vulnerability, this SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary SQL queries on the system’s backend database.

“The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.”

Given the potential to extract sensitive data or tamper with configuration records, this flaw adds a serious layer of risk, particularly when combined with other vulnerabilities.

CVE-2025-40737 & CVE-2025-40738 – Path Traversal via Malicious ZIP Extraction

Both CVEs stem from improper validation of file paths during ZIP file extraction. By crafting malicious archives, attackers can write arbitrary files to restricted directories and potentially execute code with elevated privileges.

“This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges,” Siemens stated.

These vulnerabilities are tracked as ZDI-CAN-26571 and ZDI-CAN-26572, and both score 8.8 on the CVSS v3.1 scale.

Siemens’ Recommendations

Siemens has released SINEC NMS v4.0 to remediate all known vulnerabilities. Customers are urged to immediately upgrade.

For systems where updates cannot be applied immediately, Siemens advises following their operational security guidelines and securing network access to the device.

General security practices include:

• Restricting access to trusted users and network segments
• Following Siemens’ Industrial Security guidelines
• Monitoring logs for unauthorized configuration changes

Related Posts:

• Critical Vulnerabilities Discovered in Siemens SINEC Security Monitor
• VMware Sues Siemens: Unlicensed Software Use Alleged
• Siemens Fixes 66 SQL Injection Flaws in TeleControl Server Basic
• Siemens Industrial Edge: Critical Authentication Flaw (CVE-2024-54092)
• Unauthenticated Attack: Siemens SiPass Vulnerability Risks DoS