ZDI-CAN-28759: ZDI-26-297: Siemens SINEC NMS Improper Authentication Privilege Escalation Vulnerability
Published Apr 23, 2026
·Updated
This vulnerability allows remote attackers to escalate privileges on affected installations of Siemens SINEC NMS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2026-25654.
Affected Software
1 affected component
Siemens SINEC NMS
Event History
Apr 23, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-28759?
The severity of ZDI-CAN-28759 is rated at 8 on the CVSS scale, indicating a high level of risk.
2
How do I fix ZDI-CAN-28759?
To fix ZDI-CAN-28759, it is recommended to apply the latest security updates provided by Siemens for SINEC NMS.
3
What type of vulnerability is ZDI-CAN-28759?
ZDI-CAN-28759 is an improper authentication privilege escalation vulnerability.
4
Who is affected by ZDI-CAN-28759?
Users of Siemens SINEC NMS installations are affected by ZDI-CAN-28759.
5
What can an attacker do with ZDI-CAN-28759?
An attacker can escalate privileges on affected installations of Siemens SINEC NMS if they can authenticate.