Researchers Uncover 15 Flaws In Siemens’ Industrial Network Management System

Share post:

Cybersecurity researchers have discovered 15 vulnerabilities in the Siemens SINEC network management system (NMS). The vulnerabilities are tracked from CVE-2021-33722 to CVE-2021-33736.

Siemens addressed the flaws in version V1.0 SP2 Update 1 as part of patches made available on October 12, 2021. In an advisory published at the time of fixing the vulnerabilities, Siemens stated that “the most severe flaws could allow an authenticated remote attacker to execute arbitrary code on the system with system privileges under certain conditions.”

Highly dangerous flaws in the list include CVE-2021-33723 (CVSS score: 8.8) and CVE-2021-33722 (CVSS score: 7.2).

CVE-2021-33723 allows privilege escalation to an administrator account. It could also be combined with CVE-2021-33722 (CVSS score: 7.2), a path traversal flaw, to execute arbitrary code remotely. CVE-2021-33722 can be used to execute arbitrary commands in the local database.

“The vulnerabilities, if exploited, pose a number of risks to Siemens devices on the network, including denial-of-service attacks, credential leaks, and remote code execution in certain circumstances,” the industrial security company Claroty disclosed in a new report.

The sources for this piece include an article in THEHACKERNEWS.


Related articles

Cyber Security Today, June 21, 2024 – US to ban Kaspersky for businesses, consumers

U.S. to ban the sale of Kaspersky products to consumers and businesses. Welcome to Cyber Security Today. It's Friday...

Biden administration to ban US sales of Kaspersky software over ties to Russia

The Biden administration is set to announce a ban on the sale of Kaspersky Lab's antivirus software in...

Security bug may allow anyone to spoof Microsoft employee emails

A security researcher claims to have discovered a bug that enables anyone to impersonate Microsoft corporate email accounts,...

Cyber Security Today, June 19, 2024 – How an attacker hid on an IT network for three years

How an attacker hid on an IT network for three years Welcome to Cyber Security Today. It's Wednesday June...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways