PT-2024-8704 · Sinec Ins · Sinec Ins

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-46889

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SINEC INS versions prior to V1.0 SP2 Update 3

Description A vulnerability has been identified in the affected application, which uses hard-coded cryptographic key material to obfuscate configuration files. This could allow an attacker to learn the cryptographic key material through reverse engineering of the application binary and decrypt arbitrary backup files. The issue is related to the use of a hard-coded cryptographic key, which may enable an unauthorized party to gain access to protected information.

Recommendations For versions prior to V1.0 SP2 Update 3, update to V1.0 SP2 Update 3 or later to resolve the issue. As a temporary workaround, consider restricting access to configuration files and backup files to minimize the risk of exploitation. Avoid using the affected application for sensitive operations until the issue is resolved.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

BDU:2024-10306

CVE-2024-46889

Affected Products

Sinec Ins

References · 6

• https://cert-portal.siemens.com/productcert/html/ssa-915275.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46889 · Security Note
• https://bdu.fstec.ru/vul/2024-10306 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46889 · Vendor Advisory
• https://t.me/cvedetector/10610 · Telegram Post
• https://twitter.com/CVEnew/status/1856321755893379576 · Twitter Post