CVE-2022-45093 HIGH

CVE-2022-45093

Vendor Siemens
Product SINEC INS
Weakness CWE-22 · Path traversal
Published January 10, 2023
Last update April 9, 2025

CVSS base score

8.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C

What the vulnerability does

01Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product as well as with access to the SFTP server of the affected product (22/tcp), could potentially read and write arbitrary files from and to the device's file system. An attacker might leverage this to trigger remote code execution on the affected component.

Key dates

02Disclosure timeline

January 10, 2023 CVE published
April 9, 2025 Record updated