TI-2024-31304 Aliases CVE-2024-46891 GHSA-775q-3335-qhjr

Uncontrolled resource consumption in Siemens SINEC INS

LOW 37CWE-400Published 2024-11-12 · Updated 2024-11-12

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated log files. This could allow an unauthenticated remote attacker to trigger a large amount of logged events to exhaust the system's resources and create a denial of service condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0052 44th percentileScored 2026-11-07

Fix Fixed SINEC INS (Siemens): V1.0 SP2 Update 3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SINEC INS	before V1.0 SP2 Update 3	V1.0 SP2 Update 3	Patch available	CNA

SINEC INS VendorSiemens Affected before V1.0 SP2 Update 3 Fixed in V1.0 SP2 Update 3 Patch available CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:sinec_ins::-::::::*	up to 1.0	Vulnerable	Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1::::::	1.0 sp1	Vulnerable	Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2::::::	1.0 sp2	Vulnerable	Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1::::::	1.0 sp2_update_1	Vulnerable	Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2::::::	1.0 sp2_update_2	Vulnerable	Siemens

cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:* Versions up to 1.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* Versions 1.0 sp2 Vulnerable ·Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:* Versions 1.0 sp2_update_1 Vulnerable ·Siemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:* Versions 1.0 sp2_update_2 Vulnerable ·Siemens

Remediation

Fix · CNA SINEC INS (Siemens) Fixed in V1.0 SP2 Update 3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-11-12
Siemens SINEC INS V1.0 SP2 Update 3
6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2024-31303 OS command injection in Siemens SINEC INSPriority MEDIUM 42
- TI-2024-31301 Path traversal in Siemens SINEC INSPriority MEDIUM 42
- TI-2024-31302 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3).Priority LOW 36
Show all 6 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-46891
2026-10-03 Alias added: GHSA-775q-3335-qhjr

References

Advisory 1

https://cert-portal.siemens.com/productcert/html/ssa-915275.html

TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2022-15935 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header… CVSS 3.1MEDIUM 6.5
TI-2022-22181 Path traversal in Siemens SINEC INS CVSS 3.1CRITICAL 9.9
TI-2022-13925 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does… CVSS 3.1MEDIUM 6.5
TI-2024-02335 Unbounded memory growth with session handling in TLSv1.3 CVSS 3.1MEDIUM 5.9

See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences