CVE-2024-46890

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code on the underlying OS.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Siemens	SINEC INS	< V1.0 SP2 Update 3
seimens	sinec_ins	< V1.0 SP2 Update 3

References

https://cert-portal.siemens.com/productcert/html/ssa-915275.htmlVendor Advisory

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-468917.5A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the CVE-2024-468928.1A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate s CVE-2024-468945.4A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate aut CVE-2024-468956.7Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an a CVE-2024-468965.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't access invalid sched Since 2320c9e6a768 ("drm/sched:CVE-2024-468973.8Incorrect permission assignment for critical resource issue exists in Exment v6.1.4 and earlier and Exment v5.0.11 and earlier. A logged-in CVE-2024-468987.5SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is CVE-2024-468997.1Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF contains an authentication credentials leakage vulnerabi CVE-2024-46908.0Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue CVE-2024-469014.3Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticate CVE-2024-469029.1A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informati CVE-2024-469036.5A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive informati