The vulnerability CVE-2026-25654 affects Siemens SINEC NMS versions before V4.0 SP3. It is caused by insufficient authorization checks when processing password reset requests, allowing an authenticated attacker with low privileges to reset passwords for arbitrary user accounts. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Siemens has not yet published an official fix or remediation level for this vulnerability.

Successful exploitation allows an authenticated attacker to bypass authorization controls and reset passwords of any user account, potentially leading to full account takeover. This compromises confidentiality, integrity, and availability of the system and its data. The vulnerability affects all versions of SINEC NMS prior to V4.0 SP3.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the SINEC NMS management interface to trusted users only and monitor for suspicious password reset activity. No official remediation or temporary fix has been published by Siemens at this time.