CVE-2026-46749

Description

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0012

Probability of exploitation

0.02%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-760 CWE-760

Affected Products

Vendor	Product	Versions
siemens	sinec_ins	< 1.0
siemens	sinec_ins	All
siemens	sinec_ins	All
siemens	sinec_ins	All
siemens	sinec_ins	All
siemens	sinec_ins	All
siemens	sinec_ins	All
siemens	sinec_ins	All

References

Advisories & Patches

https://cert-portal.siemens.com/productcert/html/ssa-860189.html

Frequently Asked Questions

What is CVE-2026-46749? +

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2026-46749? +

CVE-2026-46749 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0012, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-46749? +

CVE-2026-46749 affects products from siemens, specifically: sinec_ins. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-46749? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-13951 7.6

One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: …

CVE-2024-38881 7.5

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to …

CVE-2025-26486 6.0

Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a …

CVE-2026-9370 3.7

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of …

CVE-2023-51438 10.0

A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E …

CVE-2024-22039 10.0

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel …