CVE-2023-48431

highPriorität · verfolgen · 34EPSS 0.006 · 49. PerzentilDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.62% (49th) EPSS

CVSS 8.6 · high

Is it mine?

6 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-23

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). Affected software does not correctly validate the response received by an UMC server. An attacker can use this to crash the affected software by providing and configuring a malicious UMC server or by manipulating the traffic from a legitimate UMC server (i.e. leveraging CVE-2023-48427).

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSINEC INSsiemens_psirt
Update to V1.0 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109825710/
BehobenSINEC INScisa_csaf_ot
Update to V1.0 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109825710/
WorkaroundSINEC INSsiemens_psirt
Restrict access to application webserver for trusted users only
WorkaroundSINEC INScisa_csaf_ot
Restrict access to application webserver for trusted users only

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.8–8.6

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 4

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · productcert@siemens.com DEAusnutzbarkeit 2.2 · Auswirkung 4

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-754USprimärCWE-754USCWE-754US

betroffene Produkte (6)

Betroffene Produkte und Versionsbereiche.

SINEC INSalle Versionencisa_csaf_otUS
Siemens SINEC INS< V1.0_SP2_Update_2cisa_csaf_otUS
Siemens SINEC INSAll versions → V1.0 SP2 Update 2enisa_euvdEU
siemens sinec ins< 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
siemens sinec ins= 1.0nvdUScpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
Siemens SINEC INS≤ All versions < V1.0 SP2 Update 2siemens_psirtDE

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-077170SSA-077170: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 22023-12-12csaf · siemens_psirtDE
SINEC INS before V1.0 SP2 Update 2 is affected by multiple vulnerabilities. Siemens has released an update for SINEC INS and recommends to update to the latest version.
ICSA-23-348-16Siemens SINEC INS2023-12-12icsa · cisa_csaf_otUS
SINEC INS before V1.0 SP2 Update 2 is affected by multiple vulnerabilities. Siemens has released an update for SINEC INS and recommends to update to the latest version.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot nvd siemens_psirt NVD CVE.org MITRE

veröffentlicht 2023-12-12geändert 2026-06-17

verwandt (781)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-39682US	critical9.8OT kritisch	2.88% (87th)	KEV	2025-09-05
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contig…
CVE-2024-3393US	high7.5OT kritisch	29.1% (98th)	KEV	2024-12-27
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data p…
CVE-2023-41993US	high8.8OT kritisch	24.3% (98th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that t…
CVE-2023-41992US	high7.8OT kritisch	9.52% (95th)	KEV	2023-09-21
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate thei…
CVE-2021-3560US	high7.8OT kritisch	23.7% (98th)	KEV	2022-02-16
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be us…

+776 weitere

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan