Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-14 | 3 | Disclosure2Patch1 |
| 2026-04-21 | 1 | General1 |
| 2026-04-30 | 1 | Disclosure1 |
[ZDI-26-297|CVE-2026-25654] Siemens SINEC NMS Improper Authentication Privilege Escalation Vulnerability (CVSS 8.8; Credit: Rocco Calvi (@TecR0c) with TecSecurity) https://www.zerodayinitiative.com/advisories/ZDI-26-297/
Post summary
The advisory announces CVE-2026-25654 as an Improper Authentication Privilege Escalation flaw in Siemens SINEC NMS with a CVSS of 8.8, but does not provide exploit, patch, or mitigation details.
⚠️ Vulnerabilidades en productos Siemens ❗ CVE-2026-27668 ❗ CVE-2026-25654 ❗ CVE-2026-24032 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-siemens-5/ https://t.co/xaUvGrjHyI
Post summary
Three Siemens product CVEs are listed with a link for more information, but no additional details on exploitation, patches, or technical specifics are provided.
CVE-2026-25654 Authentication Bypass in SINEC NMS Versions Below 4.0 SP3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25654 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
A newly disclosed authentication bypass vulnerability (CVE-2026-25654) affecting SINEC NMS below version 4.0 SP3 is highlighted with a link to Vulmon, but no proof‑of‑concept, exploit code, patch, or exploitation activity is mentioned.
CVE: CVE-2026-25654 PT ID: PT-2026-32608 Vendor: Siemens Product: SINEC NMS CVSS: 8.8 Credits: n/a Description: A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-32608 • https://cert-portal.siemens.com/productcert/html/ssa-605717.html #dbugs_vuln
Post summary
CVE‑2026‑25654 is a disclosed vulnerability in Siemens SINEC NMS that lets an authenticated remote attacker reset any user password by bypassing authorization checks; no PoC, exploit, or patch is mentioned.
[CVE-2026-25654: HIGH] Critical cyber security alert! A vulnerability in SINEC NMS (All versions < V4.0 SP3) allows attackers to reset any user's password. Update to SP3 immediately to stay secure.#cve,CVE-2026-25654,#cybersecurity https://cvefind.com/CVE-2026-25654
Post summary
The advisory warns of a high‑severity flaw in SINEC NMS versions prior to SP3 that allows attackers to reset any user's password, recommending an upgrade to SP3 to mitigate the risk.