CVE-2023-48428

HIGH

SINEC INS < V1.0 SP2 Update 2 - Authenticated Denial of Service and OS Command Injection via Radius Certificate Upload

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly check uploaded certificates. A malicious admin could upload a crafted certificate resulting in a denial-of-service condition or potentially issue commands on system level.

References (1)

Core 1

Scores

CVSS v3 7.2
EPSS 0.0007
EPSS Percentile 20.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (2)
siemens/sinec_ins 1.0 (4 CPE variants)
siemens/sinec_ins < 1.0
Published Dec 12, 2023
Tracked Since Feb 18, 2026