CVE-2025-40736

published 2025-07-08

CVE-2025-40736: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification…

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application exposes an endpoint that allows an unauthorized modification of administrative credentials. This could allow an unauthenticated attacker to reset the superadmin password and gain full control of the application (ZDI-CAN-26569).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
siemens	sinec_nms	< V4.0	V4.0
siemens	sinec_nms	< 4.0	4.0

Detection & IOCs extracted from sources · hover to see the quote

• → CVE-2025-40736 exploits an unauthenticated endpoint in SINEC NMS that allows modification of administrative credentials (superadmin password reset). Monitor for unauthenticated HTTP requests targeting administrative credential or password-reset endpoints in SINEC NMS. ↗
• → The vulnerability is classified as Missing Authentication for Critical Function (CWE-306). Detection should focus on unauthenticated requests to privileged/administrative API endpoints in SINEC NMS, particularly those that modify credentials without prior authentication. ↗
• → All versions of Siemens SINEC NMS prior to V4.0 are affected. Identify and flag any SINEC NMS instances running versions below V4.0 in asset inventories as vulnerable to unauthenticated superadmin credential takeover. ↗

• · No known public exploitation has been reported at time of advisory publication. No specific exploit code, IOCs, or attack infrastructure have been publicly disclosed for CVE-2025-40736. ↗
• · The specific endpoint path targeted by CVE-2025-40736 is not disclosed in available public sources, limiting the ability to write precise signature-based detections without further reverse engineering or vendor disclosure. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306