Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
SINEC NMS: Unauthorized Password Resets in Older Versions
CVE-2026-25654
Summary
Older versions of SINEC NMS don't verify user access rights when resetting passwords, allowing an authorized user to reset any account's password. This means an attacker could potentially take control of any user account. Update to version 4.0 SP3 or later to fix this issue.
Original title
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow a...
Original description
A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing password reset requests. This could allow an authenticated remote attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account.
nvd CVSS3.1
8.8
nvd CVSS4.0
8.7
Vulnerability type
CWE-639
Authorization Bypass Through User-Controlled Key
Published: 14 Apr 2026 · Updated: 14 Apr 2026 · First seen: 14 Apr 2026