CVE-2024-23811

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application allows users to upload arbitrary files via TFTP. This could allow an attacker to upload malicious firmware images or other files, that could potentially lead to remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
SiemensSINEC NMS< V2.0 SP1
siemenssinec_nms< V2.0 SP1

References

Timeline

Published
Feb 13, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-238128.8A vulnerability has been identified in SINEC NMS (All versions < V2.0 SP1). The affected application incorrectly neutralizes special elementCVE-2024-238139.8A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector of the affected produCVE-2024-238145.3The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receivingCVE-2024-238157.5A vulnerability has been identified in Desigo CC (All versions if access from Installed Clients to Desigo CC server is allowed from networksCVE-2024-238169.8A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenCVE-2024-238176.1Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML InjCVE-2024-238184.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-238194.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-23825.3The Authorize.net Payment Gateway For WooCommerce plugin for WordPress is vulnerable to payment bypass in all versions up to, and including,CVE-2024-238206.5OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that CVE-2024-238214.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site scriptiCVE-2024-238229.8Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upl