Description
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths for SFTP-based file up- and downloads. This could allow an authenticated remote attacker to manipulate arbitrary files on the filesystem and achieve arbitrary code execution on the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SINEC INS | < V1.0 SP2 Update 3 | V1.0 SP2 Update 3 |
Advisories 3
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-08 Siemens SINEC INS CISA ICS & IT advisories · Nov 12, 2024
- SSA-915275 SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3 Siemens ProductCERT · Nov 12, 2024