CVE-2026-46748
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In SINEC INS prior to V1.0 SP2 Update 6, a binary is configured with the cap_dac_override capability, bypassing file system permission checks. A local attacker can escalate privileges, modify arbitrary files, and gain root access.
Risk Assessment
An attacker with local access can fully compromise the SINEC INS system, potentially disrupting industrial infrastructure.
Recommendation
Update SINEC INS to version V1.0 SP2 Update 6 or later.
Other vulnerabilities in SINEC INS
See all- CVE-2026-46749High
SINEC INS (all versions prior to V1.0 SP2 Update 6) uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and an insufficient number of iterations. This allows an attacker to efficiently recover user passwords using brute-force or precomputed attacks (e.g., rainbow tables).
- CVE-2026-46747Medium
A vulnerability in SINEC INS (all versions before V1.0 SP2 Update 6) allows path traversal via the `GET /api/sftp/uploadFiles` endpoint due to improper sanitization of path input. This enables access to unauthorized file system locations.
- CVE-2026-46746High
In SINEC INS versions prior to V1.0 SP2 Update 6, user input is not properly sanitized in the /api/sftp/uploadFiles endpoint, allowing injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved.
Original NVD description (English source)
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability allows the process to bypass file system permission checks, resulting in unrestricted file system access. This could allow a local attacker to escalate privileges leading to arbitrary file modification and gaining root privileges on the system.