VulnerabilityAwaiting Analysis

CVE-2026-25654

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3).

HIGH 8.7EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/html/ssa-605717.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.