CVE-2025-40830 Missing authorization in SINEC Security Monitor
An authenticated low-privileged local attacker can read or write arbitrary files on the server or sensor due to missing authorization checks in the file transfer feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40830?
CVE-2025-40830 is a high-severity missing authorization vulnerability in Siemens SINEC Security Monitor, published on 9 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.
Weakness: CWE-285
Which versions are affected by CVE-2025-40830?
It affects 1 product.
Products include Siemens Sinec Security Monitor.
How do I fix CVE-2025-40830?
No fix has been published for CVE-2025-40830 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-40830 being exploited?
There is no known exploitation of CVE-2025-40830 in the wild and no public exploit code.
Other vulnerabilities in Siemens SINEC Security Monitor
Sources
Also known as GHSA-35cr-f3qc-gm6j.