Not rated
CVE-2020-25237 A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0…
Description
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1 Update 1), SINEMA Server (All versions < V14.0 SP2 Update 2). When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within the intended target directory. With this an attacker could create or overwrite arbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054)
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SINEC NMS | Versions not published | |
| SINEMA Server | Versions not published |
References
- cert-portal.siemens.com cert-portal.siemens.com
- us-cert.cisa.gov us-cert.cisa.gov
- www.zerodayinitiative.com www.zerodayinitiative.com
Timeline
- Published
- Last modified
Other CVEs of SINEC NMS
The 79 CVEs of SINEC NMS →
CVE-2026-25654
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3)
8.8
High
CVE-2026-24032
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC)
7.3
High
CVE-2026-25656
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3), User Management Component (UMC) (All…
7.8
High
CVE-2026-25655
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP2)
7.8
High