CVE-2025-40737: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded…

PriorityP265high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

7.17%

93.6th percentile

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26571).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
siemens	sinec_nms	< V4.0	V4.0
siemens	sinec_nms	< 4.0	4.0

Detection & IOCsextracted from sources · hover to see the quote

→Detect ZIP file upload requests to SINEC NMS that contain path traversal sequences (e.g., '../') in archived file entry names, which may indicate exploitation of the improper path validation vulnerability. ↗
→Monitor for unexpected file writes outside of designated SINEC NMS directories following ZIP extraction operations, which may indicate a successful Zip Slip / path traversal attack. ↗
→Alert on any SINEC NMS instance running a version prior to V4.0 accepting ZIP file uploads from authenticated low-privileged users (PR:L), as exploitation requires only a network-accessible endpoint and low complexity. ↗

·CVE-2025-40737 (ZDI-CAN-26571) and CVE-2025-40738 (ZDI-CAN-26572) are two distinct path traversal vulnerabilities in SINEC NMS with identical descriptions; detection logic should account for both ZDI tracking IDs as they may involve different upload endpoints or code paths. ↗
·No known public exploitation has been reported at time of advisory publication; detection posture should be tuned accordingly but not relaxed given CVSS v4 score of 8.7 and remote/low-complexity attack vector. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.