CVE-2024-46888 — Vulnetix

Try Vulnetix Request Demo

CVE-2024-46888 PUBLISHED CVSS 9.899999618530273 CRITICAL

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths for SFTP-based file up- and downloads. This could allow an authenticated remote attacker to manipulate arbitrary files on the filesystem and achieve arbitrary code execution on the device.

EPSS 7.23% · 91.6th percentile

Risk Scores

CVSS v3.1

9.899999618530273

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

EPSS Score

7.23%

91.6th percentile

Affected Products

Vendor	Product	Versions
seimens	sinec_ins	0
siemens	sinec_ins	1.0, 1.0, 1.0
Siemens	SINEC INS	0

Timeline

Nov 12, 2024 Coalition ESS Score
Nov 12, 2024 CVE Published
Nov 12, 2024 PoC Published
Nov 12, 2024 PoC Published
Nov 13, 2024 EPSS Score
Nov 13, 2024 CVE Updated
Nov 14, 2024 Coalition ESS Score
Nov 14, 2024 PoC Published
Nov 30, 2024 EPSS Score
Jan 4, 2025 EPSS Score
Jan 21, 2025 EPSS Score
Feb 8, 2025 EPSS Score

References

Open in Interactive Console →