CVE-2021-33731: SINEC NMS SQL injection allows arbitrary database command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 7.2 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires privileged authenticated access and no KEV listing exists.

What it is

SINEC NMS versions before V1.0 SP2 Update 1 contain a SQL injection flaw (CWE-89) in its webserver. A privileged authenticated attacker can send crafted requests to execute arbitrary commands in the local database. Because the database underpins the application, successful exploitation can compromise the confidentiality, integrity and availability of the management system.

Impact

An attacker with valid privileged credentials gains the ability to run arbitrary commands in the local database, enabling data manipulation, data theft or disruption of the SINEC NMS application.

Attack surface

Reachable over the network through the application's webserver (AV:N, AC:L). Exploitation requires high privileges (PR:H) and no user interaction (UI:N).

Exploitation

Not listed in CISA KEV and no public exploit references are provided; EPSS estimates a 30-day exploitation probability of roughly 0.47 (98.8th percentile), indicating elevated predicted activity despite the absence of confirmed in-the-wild use.

What to do

• Upgrade SINEC NMS to V1.0 SP2 Update 1 or later per Siemens advisory SSA-163251.
• Restrict network access to the SINEC NMS webserver to trusted management networks.
• Enforce least privilege and review which accounts hold the privileged role required to reach the vulnerable functionality.
• Monitor and audit database activity from the SINEC NMS application for unexpected commands.
• Apply input validation and parameterized query hardening if any custom integrations touch the same database.

Detection

• Review webserver and database logs for crafted requests or anomalous SQL statements originating from SINEC NMS.
• Alert on unexpected database commands or schema changes executed by the SINEC NMS service account.
• Baseline privileged account activity and flag unusual query patterns or off-hours database access.
• Correlate webserver request logs with database audit trails to identify injection attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.