CVE-2026-46746: A vulnerability has been identified in SINEC INS (All versions < V1

Synopsis

A stored command injection vulnerability affects Siemens SINEC INS, a network services application, in all versions before V1.0 SP2 Update 6. An attacker who holds a valid (low-privilege) account can reach the /api/sftp/uploadFiles endpoint over the network, upload a crafted directory name that embeds shell commands, and trigger execution when the application later retrieves a directory listing. Successful exploitation gives the attacker arbitrary operating system command execution with the privileges of the sinecins service account. A patched-image rebuild at V1.0 SP2 Update 6 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SINEC INS application over the network to send a crafted request to the /api/sftp/uploadFiles endpoint.

• AuthenticationRequired

  The attacker must hold a valid account on the application, though any low-privilege account is sufficient.

• Victim interactionNot required

  No victim action is needed; the injected payload executes automatically when the application retrieves a directory listing.

• Attack complexityDetail

  The exploit is reliable and condition-free: no race conditions, special memory layout, or other environmental factors must be satisfied.

Blast Radius

• Executes arbitrary shell commands on the underlying operating system as the sinecins service user, giving the attacker a foothold on the host.
• Reads sensitive files and data accessible to the sinecins service account, including configuration files, credentials, and stored SFTP content.
• Modifies or deletes files and configuration data on the host within the service account's permission scope.
• Disrupts the SINEC INS service and any dependent network management functions by terminating processes or corrupting runtime state.