A flaw in SINEC Security Monitor causes confidential data such as contributor details and email addresses to be exposed through metadata on the SSM Server, creating an information‑disclosure risk that can compromise confidentiality of the system’s internal records. This weakness originates from improper handling of sensitive metadata (CWE‑1230).

The Siemens SINEC Security Monitor application is affected, specifically all releases older than version 4.9.0. No other products or versions were identified as vulnerable.

The CVSS score of 5.3 indicates a moderate severity; the EPSS score of less than 1% suggests low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be exploitation of the SSM Server’s metadata exposure, likely by any user able to query or read the server’s metadata files. While no active exploitation path is documented, the moderate score and data leakage warrant timely remediation.