CVE-2021-33734: SQL Injection
Published Oct 12, 2021
·Updated
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
Affected Software
4 affected components
Siemens SINEC NMS<1.0
Siemens SINEC NMS=1.0
Siemens SINEC NMS=1.0-sp1
Siemens SINEC NMS=1.0-sp2
Remediation
Event History
Oct 12, 2021
CVE Published
via MITRE·09:49 AM
Data Sourced
via MITRE·09:49 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-33734.
2
What is the severity of CVE-2021-33734?
CVE-2021-33734 has a severity rating of 7.2 (High).
3
What software versions are affected by CVE-2021-33734?
All versions of SINEC NMS prior to V1.0 SP2 Update 1 are affected by CVE-2021-33734.
4
How can an attacker exploit CVE-2021-33734?
A privileged authenticated attacker can exploit CVE-2021-33734 by sending crafted requests to the web server of the affected application to execute arbitrary commands in the local database.
5
Is there a fix available for CVE-2021-33734?
Yes, updating to version V1.0 SP2 Update 1 of SINEC NMS will resolve CVE-2021-33734.