Siemens SINEC INS Multiple Vulnerabilities: OS Command Injection, LPE, Weak Passwords (CVE-2026-46746~49)

Vulnerability Overview Multiple vulnerabilities exist in Siemens SINEC INS prior to V1.0 SP2 Update 6. These vulnerabilities allow attackers to execute arbitrary commands on the affected service by injecting malicious commands through carefully crafted directory names or paths. Additionally, one vulnerability allows local attackers to modify files and gain root privileges by exploiting the capability. Another vulnerability allows attackers to recover user passwords through brute-force or pre-computation attacks. Affected Products Affected Products: All versions of SINEC INS < V1.0 SP2 Update 6 Vulnerability IDs: - CVE-2026-46746 - CVE-2026-46747 - CVE-2026-46748 - CVE-2026-46749 Remediation Fixed Version: Upgrade to V1.0 SP2 Update 6 or later Remediation Link: https://support.industry.siemens.com/cs/www/zh/wv/110002283 Vulnerability Details CVE-2026-46746 Description: The application does not properly sanitize user input, allowing malicious commands to be injected via carefully crafted directory names. CVSS v3.1 Base Score: 8.8 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 8.7 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/HA:H/SC:H/NSI/NSA:N CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) CVE-2026-46747 Description: The application does not properly sanitize path input, allowing an attacker to traverse the file system using carefully crafted paths. CVSS v3.1 Base Score: 4.3 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/N/A:N CVSS v4.0 Base Score: 5.3 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/HA:N/SC:N/NSI/NSA:N CWE: CWE-22: Path Traversal: '../' CVE-2026-46748 Description: The system contains a binary file configured with the capability, allowing local attackers to modify files and gain root privileges by exploiting this capability. CVSS v3.1 Base Score: 8.8 CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 8.7 CVSS v4.0 Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/S:U/VC:H/HA:H/SC:H/NSI/NSA:N CWE: CWE-250: Execution with Unnecessary Privileges CVE-2026-46749 Description: The application uses a password hashing implementation with a statically hardcoded salt and insufficient iteration count, allowing attackers to recover user passwords via brute-force or pre-computation attacks. CVSS v3.1 Base Score: 7.5 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score: 5.0 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/S:U/VC:H/HA:H/SC:H/NSI/NSA:N CWE: CWE-760: Use of a One-Way Hash with a Predictable Salt Additional Information Publication Date: 2026-06-09 Last Updated: 2026-06-09 Current Version: V1.0 CVSS v3.1 Base Score: 8.8 CVSS v4.0 Base Score: 8.7 Acknowledgments Siemens thanks the following individuals for their contributions to the discovery of these vulnerabilities: Sirius Leonhardtsberger from Limes Security Contact Information For further information regarding security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT: https://www.siemens.com/cert/advisory History V1.0 (2026-06-09): Publication Date Terms of Use The use of Siemens security advisories is subject to Siemens terms and conditions, as detailed at: https://www.siemens.com/cert/productcert/terms-of-use

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SINEC INS Multiple Vulnerabilities: OS Command Injection, LPE, Weak Passwords (CVE-2026-46746~49)