{"id":"CVE-2024-23811","aliases":["EUVD-2024-21264","GHSA-vmw7-gx6r-25fh"],"status":"published","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00387,"percentile":0.33305,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2024-02-13T09:00:23Z","modified":"2026-06-17T07:13:39Z","products":[{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinec_nms"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-943925.html","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23811"},{"url":"https://github.com/advisories/GHSA-vmw7-gx6r-25fh"}],"sources":{"cve":[{"id":"CVE-2024-23811","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.","status":"published","published":"2024-02-13T09:00:23.301Z","modified":"2024-08-27T14:27:23.272Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:05.077718Z"}],"euvd":[{"id":"EUVD-2024-21264","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.","status":"published","published":"2024-02-13T09:00:23Z","modified":"2024-08-27T14:27:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-03T00:56:10.956482Z"}],"ghsa":[{"id":"GHSA-vmw7-gx6r-25fh","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.","status":"published","published":"2024-02-13T09:30:33Z","modified":"2024-02-13T09:30:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:36.780787Z"}],"nvd":[{"id":"CVE-2024-23811","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.","status":"published","published":"2024-02-13T09:15:49.76Z","modified":"2026-06-17T07:13:39.037Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:09:35.738752Z"}]}}