CVE-2022-25311: siemens sinec_network_management_system Improper Privilege Management

Vulnerability summary

CVE-2022-25311 is a high (CVSS 7.3) Improper Privilege Management vulnerability in siemens sinec_network_management_system. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44% of scored vulnerabilities.

Timeline

1. 08-03-2022
   PublishedVulnerability first disclosed.
2. 21-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.