CVE-2023-48429: siemens sinec_ins Unexpected Status Code or Return Value
Vulnerability summary
CVE-2023-48429 is a low (CVSS 2.7) Unexpected Status Code or Return Value vulnerability in siemens sinec_ins. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.
Timeline
- 12-12-2023PublishedVulnerability first disclosed.
- 25-02-2026Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the server. The server will automatically restart.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST2.7LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-394Unexpected Status Code or Return ValueThe product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Siemens1 product
- sinec_insAll versions < V1.0 SP2 Update 2 | < 1.0 | 1.0 | 1.0:sp1 | 1.0:sp2 | 1.0:sp2_update_1
1 vendor · 1 product