Vulnerability · Published Dec 12, 2023 · Assigned by siemens

CVE-2023-48427

High 8.1

In plain English

A high-severity improper certificate validation in SINEC INS from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected products do not properly validate the certificate of the configured UMC server. This could allow an attacker to intercept credentials that are sent to the UMC server as well as to manipulate responses, potentially allowing an attacker to escalate privileges.

Affected products (as reported)

Vendor	Product	Versions
Siemens	SINEC INS	All versions < V1.0 SP2 Update 2

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

References

https://cert-portal.siemens.com/productcert/pdf/ssa-077170.pdf