Siemens SINEC NMS SQL Injection Vulnerability Allowing Privilege Escalation

A SQL injection vulnerability has been identified in Siemens SINEC NMS, affecting all versions prior to V4.0 SP1. The vulnerability exists in the getTotalAndFilterCounts endpoint, where an authenticated low-privileged attacker could exploit it to insert malicious data and escalate privileges.

Impact

Exploitation of this vulnerability allows for SQL injection, with the potential for an authenticated low-privileged attacker to insert data and escalate privileges within the application.

Remediation

Users are advised to update SINEC NMS to version V4.0 SP1 or later. For more information, visit the Siemens support page.