CVE-2025-40831

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-882673.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:sinec_security_monitor:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary	(es) Una vulnerabilidad ha sido identificada en SINEC Security Monitor (Todas las versiones < V4.10.0). La aplicación afectada carece de validación de entrada del parámetro de fecha en la funcionalidad de generación de informes. Esto podría permitir a un atacante autenticado y con pocos privilegios causar una condición de denegación de servicio de la funcionalidad de informes.	(es) Una vulnerabilidad ha sido identificada en SINEC Security Monitor (Todas las versiones anteriores a V4.10.0). La aplicación afectada carece de validación de entrada del parámetro de fecha en la funcionalidad de generación de informes. Esto podría permitir a un atacante autenticado y con pocos privilegios causar una condición de denegación de servicio de la funcionalidad de informes.

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en SINEC Security Monitor (Todas las versiones < V4.10.0). La aplicación afectada carece de validación de entrada del parámetro de fecha en la funcionalidad de generación de informes. Esto podría permitir a un atacante autenticado y con pocos privilegios causar una condición de denegación de servicio de la funcionalidad de informes.

Information

Published : 2025-12-09 16:17

Updated : 2026-10-23 22:10

NVD link : CVE-2025-40831

Mitre link : CVE-2025-40831

CVE.ORG link : CVE-2025-40831

JSON object : View

Products Affected

siemens

sinec_security_monitor

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-40831", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40831", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T15:37:48.721938Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "SINEC Security Monitor", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.10.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-12-09T16:17:46.893", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-882673.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en SINEC Security Monitor (Todas las versiones anteriores a V4.10.0). La aplicaci\u00f3n afectada carece de validaci\u00f3n de entrada del par\u00e1metro de fecha en la funcionalidad de generaci\u00f3n de informes. Esto podr\u00eda permitir a un atacante autenticado y con pocos privilegios causar una condici\u00f3n de denegaci\u00f3n de servicio de la funcionalidad de informes."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinec_security_monitor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A1CC5F1-064E-4D68-9A3D-216027F1C4E6", "versionEndExcluding": "4.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}