CVE-2023-48427 — Improper Certificate Validation in Siemens Sinec INS

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
9.8CRITICALNVD
CNA8.1
EPSS
0.1%
top 76.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Siemens Sinec INS
Timeline
PublishedDec 12

Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDsiemens/sinec_ins< 1.0+1
▶CVEListV5siemens/sinec_insAll versions < V1.0 SP2 Update 2

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
CVEList
CVE-2023-48427: A vulnerability has been identified in SINEC INS (All versions < V1↗2023-12-12
▶
GHSA
GHSA-ffrg-8pgr-8693: A vulnerability has been identified in SINEC INS (All versions < V1↗2023-12-12
▶
CVE-2023-48427 — Improper Certificate Validation | cvebase