CVE-2024-46890

published 2024-11-12

CVE-2024-46890: A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific…

critical 9.4 CVSS 4.0

AV N AC L AT N PR H UI N VC H VI H VA H SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code on the underlying OS.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
siemens	sinec_ins	< V1.0 SP2 Update 3	V1.0 SP2 Update 3
siemens	sinec_ins	< 1.0	1.0
siemens	sinec_ins	—	—

CWE-78