CVE-2022-45093

2023-01-1011:39:43

CWE-22

siemens

www.cve.org

vulnerability

sinec ins

remote code execution

authenticated attacker

web based management

sftp server

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

58.2%

JSON

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product as well as with access to the SFTP server of the affected product (22/tcp), could potentially read and write arbitrary files from and to the device’s file system. An attacker might leverage this to trigger remote code execution on the affected component.

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "SINEC INS",
    "versions": [
      {
        "version": "All versions < V1.0 SP2 Update 1",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]