CVE-2023-48428: OS Command Injection
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The radius configuration mechanism of affected products does not correctly check uploaded certificates. A malicious admin could upload a crafted certificate resulting in a denial-of-service condition or potentially issue commands on system level.
Affected Software
Remediation
Event History
Frequently Asked Questions
What are the risks associated with CVE-2023-48428?
CVE-2023-48428 allows a malicious admin to upload a crafted certificate that could lead to a denial-of-service condition.
How can I mitigate CVE-2023-48428?
To mitigate CVE-2023-48428, users should ensure they are running Siemens SINEC INS version 1.0 SP2 Update 2 or later.
What versions of Siemens SINEC INS are affected by CVE-2023-48428?
All versions of Siemens SINEC INS prior to 1.0 SP2 Update 2 are affected by CVE-2023-48428.
What should I do if I have CVE-2023-48428 on my system?
If CVE-2023-48428 is present on your system, you should update to the latest version of Siemens SINEC INS immediately.
Is there a permanent fix for CVE-2023-48428?
The permanent fix for CVE-2023-48428 is to upgrade to Siemens SINEC INS version 1.0 SP2 Update 2 or higher.