{"id":"CVE-2025-40735","aliases":["EUVD-2025-20434","GHSA-3g42-9rvj-6j9x"],"status":"published","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00534,"percentile":0.45396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2025-07-08T10:34:52Z","modified":"2026-06-17T09:22:02Z","products":[{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"sinec_nms"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-078892.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40735"},{"url":"https://github.com/advisories/GHSA-3g42-9rvj-6j9x"}],"sources":{"cve":[{"id":"CVE-2025-40735","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.","status":"published","published":"2025-07-08T10:34:52.556Z","modified":"2025-07-08T16:11:38.334Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:34.773122Z"}],"euvd":[{"id":"EUVD-2025-20434","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.","status":"published","published":"2025-07-08T10:34:52Z","modified":"2025-07-08T16:11:38Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:32:11.045947Z"}],"ghsa":[{"id":"GHSA-3g42-9rvj-6j9x","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.","status":"published","published":"2025-07-08T12:31:02Z","modified":"2025-07-08T12:31:09Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:02:56.056966Z"}],"nvd":[{"id":"CVE-2025-40735","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.","status":"published","published":"2025-07-08T11:15:29.657Z","modified":"2026-06-17T09:22:02.917Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:16.997062Z"}]}}