CVE-2025-40830

MediumCVSS 6.7

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

Vulnerability in SINEC Security Monitor (versions < V4.10.0) due to missing proper authorization checks for the file_transfer feature in ssmctl-client command. Allows an authenticated low-privileged local attacker to read or write any file on server or sensor.

Risk Assessment

Risk of unauthorized access to system files, potentially leading to compromise of confidentiality, integrity, or availability.

Recommendation

Update SINEC Security Monitor to version V4.10.0 or later, which includes authorization fixes.

Other vulnerabilities in SINEC Security Monitor

CVE-2025-40831Medium
In SINEC Security Monitor (all versions < V4.10.0), there is a lack of input validation of the date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause a denial of service condition of the report functionality.

Original NVD description (English source)

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS