The vulnerability is an insufficient validation of user identity in the Universal Management Controller (UMC) component of SINEC NMS, allowing an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. This flaw could expose sensitive configuration data and enable further compromise if an attacker is granted access.

Siemens SINEC Network Management System is affected. All versions older than 4.0 Service Pack 3 that include the UMC component are vulnerable. Users should verify whether their installation matches these criteria.

The CVSS score of 6.9 indicates moderate-to-high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker only needs network access to the UMC interface, with no prior credentials required. The simplicity of the bypass makes exploitation relatively straightforward, raising the overall risk for exposed systems.