Siemens SINEC NMS multiple critical authentication and injection flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Four high-severity vulnerabilities in Siemens SINEC NMS allow unauthenticated remote attackers to reset passwords, inject SQL, and write arbitrary files.
CISA published a security advisory for Siemens SINEC NMS (Network Management System) covering four vulnerabilities affecting all versions prior to V4.0. The most critical flaw is CVE-2025-40736, which allows an unauthenticated attacker to reset the superadmin password and gain full control of the application through an unprotected endpoint; this carries a CVSS v4 score of 9.3. Three additional flaws enable SQL injection (CVE-2025-40735, CVSS 8.7), path traversal via ZIP file extraction allowing arbitrary file writes and code execution (CVE-2025-40737 and CVE-2025-40738, both CVSS 8.7). All four vulnerabilities are remotely exploitable with low attack complexity. Successful exploitation allows privilege escalation and arbitrary code execution on the server. No public exploitation has been reported as of the advisory date, but the authentication bypass and unauthenticated SQL injection represent an immediate risk for exposed instances.
The vulnerability was coordinated by Trend Micro Zero Day Initiative. Siemens has released patched versions; users must update to V4.0 or later. As a general defensive posture, Siemens recommends restricting network access to the NMS, deploying behind firewalls, isolating from business networks, and using VPNs for remote access. Organizations should treat SINEC NMS instances as high-value targets and prioritize patching given the criticality of network management systems in industrial environments.
Mentioned in this report
Detection guidance
SINEC NMS Application Process Spawning Command Shell
Detects a Siemens SINEC NMS server-side process spawning a shell or scripting interpreter, which is consistent with code execution after exploiting SINEC NMS flaws (ZIP path traversal, SQL injection, auth bypass). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SINEC NMS Application Process Spawning Command Shell
id: b2b4ca34-d40d-52e3-98df-4d03ef7f3fdb
status: experimental
description: Detects a process whose parent image path references Siemens SINEC NMS
spawning a command shell or script interpreter. The NMS server components do not
normally launch interactive shells, so this may indicate code execution after exploiting
the authentication bypass, SQL injection or ZIP path traversal flaws. Adjust the
parent path match to the local installation layout.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-01
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: SINEC
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Vendor installer or update scripts launched from the SINEC NMS install directory
during patching
- Administrator-configured NMS maintenance or backup scripts that invoke cmd.exe
level: medium
author: Vorant
Database Server Process Spawning Command Shell
Detects a PostgreSQL or SQL Server process spawning cmd/PowerShell, a typical outcome of SQL injection escalated to OS command execution on an application backend such as an NMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Database Server Process Spawning Command Shell
id: 801e3c8b-7741-5b67-bc57-e457372f2716
status: experimental
description: Detects database server processes (postgres.exe, sqlservr.exe) spawning
a shell or download or script utility. After SQL injection such as the unauthenticated
flaw in SINEC NMS, attackers can reach OS command execution through database features
like COPY FROM PROGRAM or xp_cmdshell.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-01
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \postgres.exe
- \sqlservr.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \certutil.exe
- \bitsadmin.exe
- \mshta.exe
filter_pg_ctl:
CommandLine|contains: pg_ctl
condition: selection and not filter_pg_ctl
falsepositives:
- DBA-configured backup or maintenance jobs that call cmd.exe via xp_cmdshell or archive_command
- PostgreSQL archive_command or WAL shipping scripts that use cmd.exe
level: high
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs