8.8
High
CVE-2026-25654 A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3)
Description
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SINEC NMS | Versions not published |
References
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Last modified
Other CVEs of SINEC NMS
The 79 CVEs of SINEC NMS →
CVE-2026-24032
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC)
7.3
High
CVE-2026-25656
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All…
7.8
High
CVE-2026-25655
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2)
7.8
High
CVE-2025-15467
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can…
Not rated