CVE-2021-33732: SQL Injection

Q: What is CVE-2021-33732?

CVE-2021-33732 is a vulnerability identified in SINEC NMS (All versions < V1.0 SP2 Update 1) that allows a privileged authenticated attacker to execute arbitrary commands in the local database.

Q: How severe is CVE-2021-33732?

CVE-2021-33732 has a severity rating of 7.2 (high).

Q: Which software versions are affected by CVE-2021-33732?

The affected software versions are SINEC NMS < V1.0 SP2 Update 1, 1.0, 1.0-SP1, and 1.0-SP2.

Q: What is the Common Weakness Enumeration (CWE) ID for CVE-2021-33732?

The CWE ID for CVE-2021-33732 is CWE-89.

Q: How can the CVE-2021-33732 vulnerability be fixed?

To fix the CVE-2021-33732 vulnerability, it is recommended to update the affected SINEC NMS software to version V1.0 SP2 Update 1 or newer.

Published Oct 12, 2021

Updated

A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.

Affected Software

4 affected components

Siemens SINEC NMS<1.0

Siemens SINEC NMS=1.0

Siemens SINEC NMS=1.0-sp1

Siemens SINEC NMS=1.0-sp2

Remediation

Patch Available

https://cert-portal.siemens.com/productcert/pdf/ssa-163251.pdf

Event History

Oct 12, 2021

CVE Published

via MITRE·09:49 AM

Data Sourced

via MITRE·09:49 AM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-33732?

CVE-2021-33732 is a vulnerability identified in SINEC NMS (All versions < V1.0 SP2 Update 1) that allows a privileged authenticated attacker to execute arbitrary commands in the local database.

How severe is CVE-2021-33732?

CVE-2021-33732 has a severity rating of 7.2 (high).

Which software versions are affected by CVE-2021-33732?