CVE-2023-48430 Denial of service in SINEC INS

What is CVE-2023-48430?

CVE-2023-48430 is a low-severity denial of service vulnerability in Siemens SINEC INS, published on 12 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The REST API of affected devices does not check the length of parameters in certain conditions. This allows a malicious admin to crash the server by sending a crafted request to the API. The server will automatically restart.

Weakness: CWE-392

Which versions are affected by CVE-2023-48430?

It affects 1 product.

Products include Siemens Sinec Ins.

How do I fix CVE-2023-48430?

No fix has been published for CVE-2023-48430 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-48430 being exploited?

There is no known exploitation of CVE-2023-48430 in the wild and no public exploit code.

Other vulnerabilities in Siemens SINEC INS

• CVE-2022-45092 Path traversal in SINEC INS Critical 9.9
• CVE-2024-46888 Path traversal in SINEC INS Critical 9.4
• CVE-2024-46890 Command injection in SINEC INS Critical 9.4
• CVE-2026-46746 Command injection in SINEC INS High 8.7
• CVE-2026-46748 Privilege escalation in SINEC INS High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r7vh-7qjc-wcjc.