Paper/Archive/CVE-2022-45092

CVE-2022-45092

Siemens SINEC INS — A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1).

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 98.3.983 × 2019.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could potentially read and write arbitrary files from and to the device's file system. An attacker might leverage this to trigger remote code execution on the affected component.

Affected

ProductAffectedFixed inSource

SINEC INSAll versions < V1.0 SP2 Update 1–CNA

Scores by source

siemens (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/pdf/ssa-332410.pdf