CVE-2026-46749: Medium severity Siemens Sinec Ins vulnerability
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SINEC INSto a version that resolves this vulnerability.Fixed in V1.0 SP2 Update 6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46749?
CVE-2026-46749 has a severity rating of 7.5, classified as high.
What types of attacks could exploit CVE-2026-46749?
CVE-2026-46749 could be exploited for password-related attacks due to its use of a static, hardcoded salt and insufficient hashing iterations.
How do I fix CVE-2026-46749?
To fix CVE-2026-46749, upgrade to SINEC INS version V1.0 SP2 Update 6 or later.
What versions of SINEC INS are affected by CVE-2026-46749?
All versions of SINEC INS prior to V1.0 SP2 Update 6 are affected by CVE-2026-46749.
Is user interaction required to exploit CVE-2026-46749?
No, user interaction is not required to exploit CVE-2026-46749.