CVE-2026-25654CWE-639

CVE-2026-25654

High · published April 14, 2026

CVSS v3.1

8.8

EPSS

Percentile

43.9

In the wild

Unconfirmed

What it is

A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00528 · 43.9th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2026-04-14T13:16Z

References (1)

https://cert-portal.siemens.com/productcert/html/ssa-605717.html · [email protected]

EPSS history

Timeline

14 APR 08:40Z
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3)
cvelistv5