This vulnerability (CWE-427) in Siemens SINEC NMS (all versions before V4.0 SP2) permits a low-privileged user to modify a configuration file improperly. This flaw can be exploited to load malicious DLLs due to uncontrolled search path elements, potentially resulting in arbitrary code execution with administrative privileges. The CVSS 3.1 score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is local attack vector with low attack complexity and no user interaction required.

Successful exploitation could allow an attacker with low privileges to execute arbitrary code with administrative rights on the affected system. This compromises system confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. Until an official fix is available, restrict low-privileged user access to configuration files and monitor for unauthorized modifications to mitigate risk.