Parameter Length Validation Flaw in SINEC INS by Siemens
CVE-2023-48429

2.7LOW

Key Information:

Vendor
Siemens
Status
SINEC INS
Vendor
CVE Published:
12 December 2023

Summary

A security flaw in the SINEC INS product allows unauthorized users to manipulate the Web UI by exploiting improper parameter length checks. When crafted requests are sent to the server, it can lead to server crashes followed by automatic restarts, potentially disrupting service availability and impacting critical operations.

Affected Version(s)

SINEC INS All versions < V1.0 SP2 Update 2

References

https://cert-portal.siemens.com/productcert/pdf/ssa-07717...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.