CVE-2026-46746

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins).

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-860189.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:siemens:sinec_ins::-::::::*
	cpe:2.3:a:siemens:sinec_ins:1.0:sp1::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4::::::
	cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5::::::

History

No history.

Information

Published : 2026-06-09 10:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-46746

Mitre link : CVE-2026-46746

CVE.ORG link : CVE-2026-46746

JSON object : View

Products Affected

siemens

sinec_ins

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-46746", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46746", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T15:12:03.665874Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "SINEC INS", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.0 SP2 Update 6", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-06-09T10:16:44.000", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-860189.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the affected service user (sinecins)."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en SINEC INS (Todas las versiones < V1.0 SP2 Update 6). La aplicaci\u00f3n no sanitiza correctamente la entrada del usuario en el endpoint /api/sftp/uploadFiles, permitiendo la inyecci\u00f3n de cargas \u00fatiles de comandos de shell a trav\u00e9s de nombres de directorio manipulados. Estas cargas \u00fatiles se almacenan y ejecutan cuando se recuperan los listados de directorios. Esto podr\u00eda permitir a un atacante remoto autenticado ejecutar comandos arbitrarios en el sistema operativo subyacente con los privilegios del usuario de servicio afectado (sinecins)."}], "lastModified": "2026-07-23T08:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinec_ins:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0309582-8D59-405A-886D-158C25B8B281", "versionEndIncluding": "1.0"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75BC588E-CDF0-404E-AD61-02093A1DF343"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A334F7B4-7283-4453-BAED-D2E01B7F8A6E"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6BEA71C-CA81-4B5D-A688-2B21E62DC351"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B405F22-5517-49F5-A7CA-1E50D58DFC75"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10CD32A2-3109-4933-84B5-FFE350E7C741"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "520B52FE-DE36-445F-ABFE-52B34DE7E00C"}, {"criteria": "cpe:2.3:a:siemens:sinec_ins:1.0:sp2_update_5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "862C9F93-4E58-4B70-97D2-9FBBCE34DBC3"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}