Lucene search
SiemensCVELIST:CVE-2021-33728HistoryOct 12, 2021 - 9:49 a.m.
CVE-2021-33728
2021-10-1209:49:28
CWE-502
siemens
www.cve.org
5
sinec nms
java object deserialization
arbitrary code execution
root privileges
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). The affected system allows to upload JSON objects that are deserialized to JAVA objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary code on the device with root privileges.
CNA Affected
[
{
"product": "SINEC NMS",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions < V1.0 SP2 Update 1"
}
]
}
]Related
prion
prion
Deserialization of untrusted data
2021-10-12 10:15:00
cnvd
cnvd
Siemens SINEC NMS code issue vulnerability
2021-10-13 00:00:00
cve
cve
CVE-2021-33728
2021-10-12 10:15:12
nvd
nvd
CVE-2021-33728
2021-10-12 10:15:12
ics
ics
Siemens SINEC NMS
2021-10-14 12:00:00
nessus
nessus
Siemens SINEC NMS < V1.0 SP2 Update 1 Multiple Vulnerabilities
2022-07-05 00:00:00