Invalid Input Validation in SINEC INS Leads to Arbitrary Code Execution

CVE-2024-46890

Summary

A significant vulnerability in SINEC INS, specifically in all versions prior to V1.0 SP2 Update 3, arises from inadequate validation of user input targeting specific endpoints of its web API. This flaw enables an authenticated remote attacker with elevated privileges to potentially execute arbitrary code on the affected operating system. The lack of proper input validation increases the risk of exploitation, thereby highlighting the need for prompt updates and enhanced security measures.

References