CVE-2021-33726: Path Traversal
Published Oct 12, 2021
·Updated
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to download arbitrary files under a user controlled path and does not correctly check if the relative path is still within the intended target directory.
Affected Software
4 affected components
Siemens SINEC NMS<1.0
Siemens SINEC NMS=1.0
Siemens SINEC NMS=1.0-sp1
Siemens SINEC NMS=1.0-sp2
Remediation
Event History
Oct 12, 2021
CVE Published
via MITRE·09:49 AM
Data Sourced
via MITRE·09:49 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-33726.
2
What is the severity of CVE-2021-33726?
CVE-2021-33726 has a severity of 7.5 (High).
3
Which software versions are affected by CVE-2021-33726?
All versions of SINEC NMS before V1.0 SP2 Update 1 are affected.
4
What is the impact of CVE-2021-33726?
The vulnerability allows an attacker to download arbitrary files under a user-controlled path and bypass intended target directory checks.
5
Is there a fix available for CVE-2021-33726?
Yes, Siemens has released an update to address the vulnerability. It is recommended to update to V1.0 SP2 Update 1 or later.