Raw vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-46749 is a medium-severity Use of a One-Way Hash with a Predictable Salt (CWE-760) vulnerability in Siemens Sinec Ins. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-35386
Vulnerability Data
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a password hashing implementation with a static, hardcoded salt shared across all users and installations, and is configured with an insufficient…
more
number of iterations. This could allow an attacker to efficiently recover user passwords using brute-force or precomputed attacks, potentially resulting in unauthorized access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V6.5.2
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection requirements can mandate approved algorithms and parameters that include unpredictable salts for password hashing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce use of unpredictable salts and strong password hashing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including proper salting, largely mitigating predictable-salt weaknesses.
Security testing in development and acceptance can detect weak password hashing implementations.
Secure development life cycle includes secure coding practices that would catch predictable-salt usage during design and implementation.
Application security requirements can specify cryptographic standards that prohibit predictable salts.
Secure system architecture and engineering principles guide the selection of strong cryptographic mechanisms including proper salting.
Secure coding explicitly prohibits predictable salts and mandates cryptographically secure random salts.