CVE-2025-40738: A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded…

PriorityP265high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

7.17%

93.6th percentile

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially execute code with elevated privileges (ZDI-CAN-26572).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
siemens	sinec_nms	< V4.0	V4.0
siemens	sinec_nms	< 4.0	4.0

Detection & IOCsextracted from sources · hover to see the quote

→Detect ZIP file upload requests to SINEC NMS where the archive contains path traversal sequences (e.g., '../') in filenames, indicating an attempt to write files outside the intended extraction directory. ↗
→Monitor for unexpected file creation events in restricted or system directories on SINEC NMS hosts following ZIP file upload operations, which may indicate successful path traversal exploitation. ↗
→Alert on any process execution with elevated privileges spawned from or shortly after a ZIP extraction operation within SINEC NMS, as this may indicate post-exploitation code execution via the path traversal vulnerability. ↗

·CVE-2025-40738 affects ALL versions of Siemens SINEC NMS prior to V4.0; only upgrading to V4.0 or later remediates this vulnerability. Detection efforts should prioritize unpatched deployments. ↗
·This vulnerability requires low privileges (PR:L) to exploit remotely with low attack complexity, meaning any authenticated low-privileged user could attempt exploitation — detection should not be limited to admin-level accounts. ↗
·No known public exploitation has been reported as of the advisory date; however, the vulnerability is exploitable remotely with low attack complexity, warranting proactive monitoring. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.