Read the docs
TI-2026-34367 Aliases CVE-2026-46746GHSA-vxxj-9x7w-4356

OS command injection in Siemens SINEC INS

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed SINEC INS (Siemens): V1.0 SP2 Update 6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSINEC INSbefore V1.0 SP2 Update 6V1.0 SP2 Update 6Patch availableCNA
  • SINEC INS VendorSiemens Affected before V1.0 SP2 Update 6 Fixed in V1.0 SP2 Update 6 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:*up to 1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*1.0 sp1VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*1.0 sp2VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:*1.0 sp2_update_1VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*1.0 sp2_update_2VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3:*:*:*:*:*:*1.0 sp2_update_3VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4:*:*:*:*:*:*1.0 sp2_update_4VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5:*:*:*:*:*:*1.0 sp2_update_5VulnerableSiemens
  • cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:* Versions up to 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* Versions 1.0 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:* Versions 1.0 sp2_update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:* Versions 1.0 sp2_update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3:*:*:*:*:*:* Versions 1.0 sp2_update_3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4:*:*:*:*:*:* Versions 1.0 sp2_update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5:*:*:*:*:*:* Versions 1.0 sp2_update_5 Vulnerable ·Siemens

Remediation

  • Fix · CNA SINEC INS (Siemens) Fixed in V1.0 SP2 Update 6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SINEC INS V1.0 SP2 Update 6

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-34369 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Priority LOW 39
    • TI-2026-34370 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Priority LOW 24
    • TI-2026-34368 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Priority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46746
  2. 2026-10-03 Alias added: GHSA-vxxj-9x7w-4356
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-15935 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header… CVSS 3.1MEDIUM 6.5
  • TI-2022-22181 Path traversal in Siemens SINEC INS CVSS 3.1CRITICAL 9.9
  • TI-2022-13925 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does… CVSS 3.1MEDIUM 6.5
  • TI-2024-02335 Unbounded memory growth with session handling in TLSv1.3 CVSS 3.1MEDIUM 5.9
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences