{"id":"CVE-2026-24032","aliases":["EUVD-2026-22233","GHSA-7f3f-wq83-6q76"],"status":"published","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\r\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00251,"percentile":0.16575,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-347"],"published":"2026-04-14T08:40:39Z","modified":"2026-10-24T13:10:00Z","products":[{"vendor":"siemens","product":"sinec nms"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-801704.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24032"},{"url":"https://github.com/advisories/GHSA-7f3f-wq83-6q76"}],"sources":{"cve":[{"id":"CVE-2026-24032","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\r\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)","status":"published","published":"2026-04-14T08:40:39.853Z","modified":"2026-04-14T13:18:01.056Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:19:50.575061Z"}],"euvd":[{"id":"EUVD-2026-22233","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\r\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)","status":"published","published":"2026-04-14T08:40:39Z","modified":"2026-04-14T13:18:01Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:26.535553Z"}],"ghsa":[{"id":"GHSA-7f3f-wq83-6q76","title":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected...","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)","status":"published","published":"2026-04-14T09:30:44Z","modified":"2026-04-14T09:30:53Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:07:28.42851Z"}],"nvd":[{"id":"CVE-2026-24032","description":"A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\r\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)","status":"published","published":"2026-04-14T09:16:34.9Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:14.37744Z"}]}}