CVE-2025-40830

Medium · 6.7

CVSS

6.7

EPSS

0.2%

Published

Dec 9, 2025

CISA due date

—

The record

A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected application does not have proper authorization checks for the file_transfer feature in ssmctl-client command. This could allow an authenticated, lowly privileged local attacker to read or write to any file on server or sensor.

Affected packages

Ecosystem	Package	Introduced	Fixed