CVE-2022-45092: critical vulnerability in Siemens SINEC INS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An authenticated attacker with access to a SINEC INS device's web management interface can read and write any files on the device, potentially leading to remote code execution. This is critical because it allows complete compromise of the affected system.
Path traversal vulnerability (CWE-22) in SINEC INS web management interface (443/tcp) allows authenticated remote attackers to perform arbitrary file read/write operations on the device filesystem. Exploitation requires prior authentication but enables arbitrary code execution on the affected component.
In the same product, most dangerous first.