ZDI-CAN-28108: ZDI-26-132: Siemens SINEC NMS Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Siemens SINEC NMS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-25656.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-28108?
The severity of ZDI-CAN-28108 is considered high due to its potential for local privilege escalation.
How do I fix ZDI-CAN-28108?
To fix ZDI-CAN-28108, update affected installations of Siemens SINEC NMS to the latest version as recommended by Siemens.
Who is affected by ZDI-CAN-28108?
ZDI-CAN-28108 affects local users on systems running Siemens SINEC NMS.
What type of vulnerability is ZDI-CAN-28108?
ZDI-CAN-28108 is classified as an Uncontrolled Search Path Element local privilege escalation vulnerability.
Can ZDI-CAN-28108 be exploited remotely?
No, ZDI-CAN-28108 requires local access for exploitation, making it a local privilege escalation issue.