Siemens SINEC INS

Summary

Vulnerabilities 7

• High 8.1
  CVE-2023-48427

  A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly …

  Siemens SINEC INS ICS / OT
  Dec 12, 2023
• High 7.7
  CVE-2023-27538

  An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH c…

  mysql curl curl curl Debian Ubuntu Azure Linux Alpine
  Mar 30, 2023
• High 7.5
  CVE-2023-0464 Public exploit

  Excessive Resource Usage Verifying X.509 Policy Constraints

  A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 22, 2023
• High 7.2
  CVE-2023-48428

  A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism…

  Siemens SINEC INS ICS / OT
  Dec 12, 2023
• Medium 6.8
  CVE-2023-48431

  A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correct…

  Siemens SINEC INS ICS / OT
  Dec 12, 2023
• Low 2.7
  CVE-2023-48429

  A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices doe…

  Siemens SINEC INS ICS / OT
  Dec 12, 2023
• Low 2.7
  CVE-2023-48430

  A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices d…

  Siemens SINEC INS ICS / OT
  Dec 12, 2023

Revision history

1. 2023-12-12 #1

   Publication Date

References

• SSA-077170: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 2 - HTML Version
  https://cert-portal.siemens.com/productcert/html/ssa-077170.html
• SSA-077170: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 2 - PDF Version
  https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf
• SSA-077170: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 2 - TXT Version
  https://cert-portal.siemens.com/productcert/txt/ssa-077170.txt
• ICS Advisory ICSA-23-348-16 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-16
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B