CVE-2025-40738

High

Published: 08 July 2025

Published

08 July 2025

Modified

21 August 2025

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0172 82.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40738 is a high-severity Path Traversal (CWE-22) vulnerability in Siemens Sinec Nms. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-40738 affects Siemens SINEC NMS versions prior to V4.0. The flaw is a path traversal issue (CWE-22) in which the application fails to validate file paths during extraction of user-uploaded ZIP archives, allowing writes to arbitrary locations on the underlying file system.

An authenticated attacker with network access can supply a malicious ZIP that overwrites files outside the intended extraction directory. Successful exploitation can lead to arbitrary code execution with elevated privileges on the NMS server.

The Siemens advisory SSA-078892 recommends upgrading to SINEC NMS V4.0 or later, which contains the fix for the improper path validation during ZIP extraction.

EPSS remains low at 0.0172 with no material increase since disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-20431

Vulnerability details

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded ZIP files. This could allow an attacker to write arbitrary files to restricted locations and potentially…

execute code with elevated privileges (ZDI-CAN-26572).

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Path traversal in ZIP extraction enables arbitrary file write leading to web shell deployment and RCE with privilege escalation on a public-facing app.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1