CVE-2024-46894 Siemens CVE debrief

Who should care

Organizations operating Siemens SINEC INS in industrial network environments, particularly those exposing management interfaces to operational networks or with multiple administrative users requiring SFTP service configuration access.

Technical summary

Siemens SINEC INS contains an authorization bypass vulnerability in the /api/sftp/users endpoint. The application fails to validate that an authenticated user has proper authorization before allowing queries to this endpoint. An authenticated remote attacker can exploit this flaw to obtain a list of configured SFTP service users and modify the SFTP user configuration. The vulnerability requires network access and valid credentials but no user interaction. CVSS 3.1: 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Remediation is available via vendor update to V1.0 SP2 Update 3 or later.

Defensive priority

medium

Recommended defensive actions

• Apply vendor fix: Update Siemens SINEC INS to V1.0 SP2 Update 3 or later version
• Review and audit SFTP user configurations for unauthorized modifications
• Implement network segmentation to limit access to SINEC INS management interfaces
• Monitor /api/sftp/users endpoint access for anomalous authenticated requests
• Apply principle of least privilege for SINEC INS administrative accounts

Evidence notes

Authorization failure on /api/sftp/users endpoint allows authenticated attackers to read and modify SFTP user configuration. CVSS 6.3 reflects network-accessible attack with low complexity and privilege requirements. Vendor fix available via Siemens support portal.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.