Read the docs
TI-2026-34369 Aliases CVE-2026-46748GHSA-c23g-cgv4-p67j

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).

Priority LOW 39CWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Fixed SINEC INS (Siemens): V1.0 SP2 Update 6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSINEC INSbefore V1.0 SP2 Update 6V1.0 SP2 Update 6Patch availableCNA
  • SINEC INS VendorSiemens Affected before V1.0 SP2 Update 6 Fixed in V1.0 SP2 Update 6 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:*up to 1.0VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*1.0 sp1VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*1.0 sp2VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:*1.0 sp2_update_1VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*1.0 sp2_update_2VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3:*:*:*:*:*:*1.0 sp2_update_3VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4:*:*:*:*:*:*1.0 sp2_update_4VulnerableSiemens
cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5:*:*:*:*:*:*1.0 sp2_update_5VulnerableSiemens
  • cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:* Versions up to 1.0 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* Versions 1.0 sp2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:* Versions 1.0 sp2_update_1 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:* Versions 1.0 sp2_update_2 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3:*:*:*:*:*:* Versions 1.0 sp2_update_3 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4:*:*:*:*:*:* Versions 1.0 sp2_update_4 Vulnerable ·Siemens
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5:*:*:*:*:*:* Versions 1.0 sp2_update_5 Vulnerable ·Siemens

Remediation

  • Fix · CNA SINEC INS (Siemens) Fixed in V1.0 SP2 Update 6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SINEC INS V1.0 SP2 Update 6

    4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-34367 OS command injection in Siemens SINEC INSPriority MEDIUM 40
    • TI-2026-34370 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Priority LOW 24
    • TI-2026-34368 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6).Priority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46748
  2. 2026-10-03 Alias added: GHSA-c23g-cgv4-p67j
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2022-15935 The llhttp parser in the http module in Node v18.7.0 does not correctly handle header… CVSS 3.1MEDIUM 6.5
  • TI-2022-22181 Path traversal in Siemens SINEC INS CVSS 3.1CRITICAL 9.9
  • TI-2022-13925 The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does… CVSS 3.1MEDIUM 6.5
  • TI-2024-02335 Unbounded memory growth with session handling in TLSv1.3 CVSS 3.1MEDIUM 5.9
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences