CVE-2024-46889

CWE-3213 documents3 sources
Severity
6.9MEDIUM
EPSS
0.4%
top 38.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Siemens Sinec INS
Timeline
PublishedNov 12

Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obfuscate configuration files. This could allow an attacker to learn that cryptographic key material through reverse engineering of the application binary and decrypt arbitrary backup files.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5siemens/sinec_ins< V1.0 SP2 Update 3
▶NVDsiemens/sinec_ins< 1.0+1

🔴Vulnerability Details

2
CVEList
CVE-2024-46889: A vulnerability has been identified in SINEC INS (All versions < V1↗2024-11-12
▶
GHSA
GHSA-qhpc-32r3-qpcv: A vulnerability has been identified in SINEC INS (All versions < V1↗2024-11-12
▶
CVE-2024-46889 (MEDIUM CVSS 6.9) | A vulnerability has been identified | cvebase.io