Researchers Uncover 15 Flaws In Siemens’ Industrial Network Management System

Cybersecurity researchers have discovered 15 vulnerabilities in the Siemens SINEC network management system (NMS). The vulnerabilities are tracked from CVE-2021-33722 to CVE-2021-33736.

Siemens addressed the flaws in version V1.0 SP2 Update 1 as part of patches made available on October 12, 2021. In an advisory published at the time of fixing the vulnerabilities, Siemens stated that “the most severe flaws could allow an authenticated remote attacker to execute arbitrary code on the system with system privileges under certain conditions.”

Highly dangerous flaws in the list include CVE-2021-33723 (CVSS score: 8.8) and CVE-2021-33722 (CVSS score: 7.2).

CVE-2021-33723 allows privilege escalation to an administrator account. It could also be combined with CVE-2021-33722 (CVSS score: 7.2), a path traversal flaw, to execute arbitrary code remotely. CVE-2021-33722 can be used to execute arbitrary commands in the local database.

“The vulnerabilities, if exploited, pose a number of risks to Siemens devices on the network, including denial-of-service attacks, credential leaks, and remote code execution in certain circumstances,” the industrial security company Claroty disclosed in a new report.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web