siemens sinec-ins CVE-2023-48427 is a vulnerability in Siemens Sinec Ins
Published on December 12, 2023

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2023-48427 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.


Products Associated with CVE-2023-48427

You can be notified by stack.watch whenever vulnerabilities like CVE-2023-48427 are published in these products:

Siemens Sinec Ins
 

What versions of Sinec Ins are vulnerable to CVE-2023-48427?