Cybersecurity researchers have discovered 15 vulnerabilities in the Siemens SINEC network management system (NMS). The vulnerabilities are tracked from CVE-2021-33722 to CVE-2021-33736.
Siemens addressed the flaws in version V1.0 SP2 Update 1 as part of patches made available on October 12, 2021. In an advisory published at the time of fixing the vulnerabilities, Siemens stated that “the most severe flaws could allow an authenticated remote attacker to execute arbitrary code on the system with system privileges under certain conditions.”
Highly dangerous flaws in the list include CVE-2021-33723 (CVSS score: 8.8) and CVE-2021-33722 (CVSS score: 7.2).
CVE-2021-33723 allows privilege escalation to an administrator account. It could also be combined with CVE-2021-33722 (CVSS score: 7.2), a path traversal flaw, to execute arbitrary code remotely. CVE-2021-33722 can be used to execute arbitrary commands in the local database.
“The vulnerabilities, if exploited, pose a number of risks to Siemens devices on the network, including denial-of-service attacks, credential leaks, and remote code execution in certain circumstances,” the industrial security company Claroty disclosed in a new report.