CERT-In Vulnerability Note
CIVN-2023-0380
Multiple Vulnerabilities in Siemens SINEC INS
Original Issue Date:December 21, 2023
Severity Rating: HIGH
Software Affected
- SINEC INS All versions < V1.0 SP2 Update 2
Overview
Multiple vulnerabilities have been reported in the Siemens SINEC INS, which could be exploited by an attacker to obtain unauthorized access, cause denial of service condition on the targeted system, intercept credentials, escalate privileges, crash the server by sending crafted request.
Description
Multiple vulnerabilities exist in SINEC INS Product due to improper certificate validation, improper input validation, improper neutralization of special elements used in an OS command, unexpected status code or return value, missing report of error condition and improper check for unusual or exceptional conditions.
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized access, intercept credentials, escalate privileges, inject commands, crashing the server/software by crafted request and creation of denial of service condition on the targeted system.
Workaround
- Restrict access to webserver for trusted users only
Solution
Apply appropriate fix/patches as mentioned:
https://cert-portal.siemens.com/productcert/html/ssa-077170.html
Vendor Information
Siemens
https://cert-portal.siemens.com/productcert/html/ssa-077170.html
References
Siemens
https://cert-portal.siemens.com/productcert/html/ssa-077170.html
CVE Name
CVE-2023-0464
CVE-2023-27538
CVE-2023-48427
CVE-2023-48428
CVE-2023-48429
CVE-2023-48430
CVE-2023-48431
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|