CVE-2022-25311

State: Published
Severity: 7.3 High
Published: Mar 8, 2022
Updated: Apr 21, 2025
Reserved: Feb 17, 2022

Description

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C	siemens

Weaknesses

CWE-269 Improper Privilege Management

Affected Products

Product	Versions
SINEC NMSSiemens	All versions >= V1.0.3 < V2.0Affected
SINEC NMSSiemens	All versions < V1.0.3Affected
SINEMA Server V14Siemens	All versionsAffected

References

https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.