CVE-2025-40830

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.

• CWE-285

• https://cert-portal.siemens.com/productcert/html/ssa-882673.htmlVendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-40819A vulnerability has been identified in SINEMA Remote Connect…4.3
• CVE-2025-4082Modification of specific WebGL shader attributes could trigg…5.9
• CVE-2025-40820Affected products do not properly enforce TCP sequence numbe…8.7
• CVE-2025-40827A vulnerability has been identified in Siemens Software Cent…8.5
• CVE-2025-40829A vulnerability has been identified in Simcenter Femap (All …7.8
• CVE-2025-4083A process isolation vulnerability in Thunderbird stemmed fro…9.1
• CVE-2025-40831A vulnerability has been identified in SINEC Security Monito…7.1
• CVE-2025-40833The affected devices contain a null pointer dereference vuln…8.7
• CVE-2025-40834A vulnerability has been identified in Mendix RichText (All …6.8
• CVE-2025-40836Ericsson Indoor Connect 8855 contains an improper input vali…9.8
• CVE-2025-40837Ericsson Indoor Connect 8855 contains a missing authorizatio…8.8
• CVE-2025-40838Ericsson Indoor Connect 8855 contains a vulnerability where …7.5