« Back to list

CVE-2021-33725

Status: ModifiedCritical (9.1)—

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Siemens — Sinec NMS

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2021-33725",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SINEC NMS",
          "versions": [
            {
              "status": "affected",
              "version": "All versions < V1.0 SP2 Update 1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-12T10:15:11.863",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to delete arbitrary files or directories under a user controlled path and does not correctly check if the relative path is still within the intended target directory."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SINEC NMS (Todas las versiones anteriores a V1.0 SP2 Update 1). El sistema afectado permite eliminar archivos o directorios arbitrarios bajo una ruta controlada por el usuario y no comprueba correctamente si la ruta relativa sigue estando dentro del directorio de destino previsto"
    }
  ],
  "lastModified": "2026-06-17T03:55:06.803",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B59D696-F272-40DA-8DC6-423D9E5026C0",
              "versionEndExcluding": "1.0"
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinec_nms:1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4ED13FC8-63C0-42C6-A51C-C480C45327C2"
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinec_nms:1.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E68FE047-8F53-46B8-82D4-9342B1C8CA55"
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinec_nms:1.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F2C66EC-5A29-4B92-AEDB-7DB8A5CA7391"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}