SINEC INS <1.0 SP2 Update 2 UMC Cert Validation Flaw
CVE-2023-48427 Published on December 12, 2023
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.
Weakness Type
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.
Products Associated with CVE-2023-48427
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2023-48427 are published in Siemens Sinec Ins:
Affected Versions
Siemens SINEC INS Version All versions < V1.0 SP2 Update 2 is affected by CVE-2023-48427Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.