{"id":"CVE-2022-25311","aliases":["EUVD-2022-29995","GHSA-35fm-4q2r-j938"],"status":"published","title":"A vulnerability has been identified in SINEC NMS (All versions). The affected software do not...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003e= V1.0.3 \u003c V2.0), SINEC NMS (All versions \u003c V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00537,"percentile":0.45499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2022-03-08T00:00:00Z","modified":"2026-06-17T04:33:22Z","products":[{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinec_network_management_system"},{"vendor":"siemens","product":"sinema server v14"},{"vendor":"siemens","product":"sinema_server"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf","tags":["x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25311"},{"url":"https://github.com/advisories/GHSA-35fm-4q2r-j938"}],"sources":{"cve":[{"id":"CVE-2022-25311","description":"A vulnerability has been identified in SINEC NMS (All versions \u003e= V1.0.3 \u003c V2.0), SINEC NMS (All versions \u003c V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.","status":"published","published":"2022-03-08T00:00:00Z","modified":"2025-04-21T13:55:26.745Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-29995","description":"A vulnerability has been identified in SINEC NMS (All versions \u003e= V1.0.3 \u003c V2.0), SINEC NMS (All versions \u003c V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.","status":"published","published":"2022-03-08T00:00:00Z","modified":"2025-04-21T13:55:26Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C","level":"high"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-35fm-4q2r-j938","title":"A vulnerability has been identified in SINEC NMS (All versions). The affected software do not...","description":"A vulnerability has been identified in SINEC NMS (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.","status":"published","published":"2022-03-09T00:00:44Z","modified":"2023-02-01T05:07:05Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:50:28.921795Z"}],"nvd":[{"id":"CVE-2022-25311","description":"A vulnerability has been identified in SINEC NMS (All versions \u003e= V1.0.3 \u003c V2.0), SINEC NMS (All versions \u003c V1.0.3), SINEMA Server V14 (All versions). The affected software do not properly check privileges between users during the same web browser session, creating an unintended sphere of control. This could allow an authenticated low privileged user to achieve privilege escalation.","status":"published","published":"2022-03-08T12:15:11.727Z","modified":"2026-06-17T04:33:22.227Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:13.7085Z"}]}}