CVE-2026-46749: Medium severity Siemens Sinec Ins vulnerability
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SINEC INSto a version that resolves this vulnerability.Fixed in V1.0 SP2 Update 6 - Configuration
Replace the static, hardcoded salt with a cryptographically secure, per-user random salt when hashing and storing passwords.
SINEC INS password hashing implementation salt = per-user unique random salt (not hardcoded) - Configuration
Increase the hash iteration/work factor to a modern, computationally expensive value appropriate for the chosen hashing algorithm to slow brute-force and precomputed attacks.
SINEC INS password hashing implementation iteration count = increase to a sufficiently large work factor - Compensating control
Until fixes are applied, mitigate risk by enforcing additional controls such as requiring multi-factor authentication for user access and restricting administrative access via network controls (VPN/firewall/ACL) to trusted IPs.
- Operational
Force a password reset for all users (rotate credentials) and invalidate existing password hashes created with the static salt/low iteration count after applying the fixes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46749?
CVE-2026-46749 has a severity rating of 7.5, classified as high.
What types of attacks could exploit CVE-2026-46749?
CVE-2026-46749 could be exploited for password-related attacks due to its use of a static, hardcoded salt and insufficient hashing iterations.
How do I fix CVE-2026-46749?
To fix CVE-2026-46749, upgrade to SINEC INS version V1.0 SP2 Update 6 or later.
What versions of SINEC INS are affected by CVE-2026-46749?
All versions of SINEC INS prior to V1.0 SP2 Update 6 are affected by CVE-2026-46749.
Is user interaction required to exploit CVE-2026-46749?
No, user interaction is not required to exploit CVE-2026-46749.