PT-2023-14602 · Siemens · Sinec Ins

Published 2023-01-10 · Updated 2023-01-14 · CVE-2022-45094

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC INS versions prior to V1.0 SP2 Update 1

Description A vulnerability has been identified that allows an authenticated remote attacker with access to the Web Based Management (443/tcp) to potentially inject commands into the dhcpd configuration. This could be leveraged to trigger remote code execution on the affected component.

Recommendations For versions prior to V1.0 SP2 Update 1, update to V1.0 SP2 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Web Based Management interface on port 443/tcp to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-45094

Affected Products

Sinec Ins

References · 4

• https://osv.dev/vulnerability/CVE-2022-45094 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45094 · Security Note
• https://t.me/cibsecurity/56221 · Telegram Post