Siemens SINEC NMS Authorization Bypass Vulnerability Allowing Password Reset on All Versions Prior to V4.0 SP3

An authorization bypass vulnerability has been identified in Siemens SINEC NMS, affecting all versions prior to V4.0 SP3. The vulnerability arises because affected products do not properly validate user authorization when handling password reset requests. This flaw could enable an authenticated remote attacker to bypass authorization checks and reset the password of any user account.

Impact

Exploitation of this vulnerability could lead to unauthorized password resets, allowing attackers to gain access to user accounts.

Remediation

Users are advised to update SINEC NMS to version V4.0 SP3 or later. For more information, visit the Siemens Industry Support page.