CVE-2025-40831

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

In SINEC Security Monitor (all versions < V4.10.0), there is a lack of input validation of the date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause a denial of service condition of the report functionality.

Risk Assessment

An attacker can prevent report generation, potentially disrupting security monitoring and decision-making processes in the organization.

Recommendation

It is recommended to update SINEC Security Monitor to version V4.10.0 or later, which includes an input validation fix.

Other vulnerabilities in SINEC Security Monitor

CVE-2025-40830Medium
Vulnerability in SINEC Security Monitor (versions < V4.10.0) due to missing proper authorization checks for the file_transfer feature in ssmctl-client command. Allows an authenticated low-privileged local attacker to read or write any file on server or sensor.

Original NVD description (English source)

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application lacks input validation of date parameter in report generation functionality. This could allow an authenticated, lowly privileged attacker to cause denial of service condition of the report functionality.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS