CVE-2022-45092

Deeper analysis

A path traversal vulnerability tracked as CVE-2022-45092 affects Siemens SINEC INS in all versions prior to V1.0 SP2 Update 1. The flaw resides in the Web Based Management interface listening on TCP port 443 and is classified under CWE-22. An authenticated remote attacker can supply crafted requests that read or write arbitrary files on the underlying file system, which may be leveraged to achieve remote code execution.

Because the attack requires valid credentials and network access to the management interface, an adversary who has already obtained low-privileged web credentials can fully compromise the confidentiality, integrity, and availability of the affected appliance. The CVSS 3.1 score of 9.9 reflects the combination of network attack vector, low complexity, and the change in scope that allows the attacker to impact resources beyond the vulnerable component itself.

Siemens advisory SSA-332410 states that the issue is resolved in SINEC INS V1.0 SP2 Update 1 and later; administrators should apply the update and restrict web-management access to trusted networks. The EPSS score rose from a low baseline to a peak of 0.3535 on 2025-12-11 before receding to the current value of 0.0381, indicating a period of increased exploitation interest after public disclosure.