Siemens Sinec Ins vulnerabilities

42 CVEs affecting Siemens Sinec Ins, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46749, published 2026-06-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-2068, published 2022-06-21. High severity, CVSS 7.3. EPSS: 96.4% chance of exploitation in the next 30 days. In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command…
CVE-2022-32215, published 2022-07-14. Medium severity, CVSS 6.5. EPSS: 70.2% chance of exploitation in the next 30 days. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
CVE-2022-32213, published 2022-07-14. Medium severity, CVSS 6.5. EPSS: 46% chance of exploitation in the next 30 days. The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVE-2022-45092, published 2023-01-10. High severity, CVSS 8.8. EPSS: 31.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could…
CVE-2021-23337, published 2021-02-15. High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2021-3749, published 2021-08-31. High severity, CVSS 7.5. EPSS: 8.5% chance of exploitation in the next 30 days. axios is vulnerable to Inefficient Regular Expression Complexity
CVE-2021-23841, published 2021-02-16. Medium severity, CVSS 5.9. EPSS: 7.4% chance of exploitation in the next 30 days. The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails…
CVE-2020-28500, published 2021-02-15. Medium severity, CVSS 5.3. EPSS: 7.3% chance of exploitation in the next 30 days. Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2021-22945, published 2021-09-23. Critical severity, CVSS 9.1. EPSS: 6.7% chance of exploitation in the next 30 days. When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed memory area and both use that again in a subsequent call…

Latest

CVE-2026-46749, published 2026-06-09. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all…
CVE-2026-46748, published 2026-06-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected system includes a binary that is configured with the cap_dac_override capability. This capability…
CVE-2026-46747, published 2026-06-09. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application does not properly sanitize path input in the `GET /api/sftp/uploadFiles` endpoint used…
CVE-2026-46746, published 2026-06-09. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the…
CVE-2024-46894, published 2024-11-12. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate authorization of a user to query the "/api/sftp/users"…
CVE-2024-46892, published 2024-11-12. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly invalidate sessions when the associated user is deleted or disabled or…
CVE-2024-46891, published 2024-11-12. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly restrict the size of generated log files. This could allow an…
CVE-2024-46890, published 2024-11-12. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly validate input sent to specific endpoints of its web API. This could…
CVE-2024-46889, published 2024-11-12. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application uses hard-coded cryptographic key material to obfuscate configuration files. This could…
CVE-2024-46888, published 2024-11-12. Critical severity, CVSS 9.9. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 3). The affected application does not properly sanitize user provided paths for SFTP-based file up- and downloads.…