Siemens SINEC INS Password Hashing Vulnerability Allowing Password Recovery

A vulnerability exists in Siemens SINEC INS versions prior to V1.0 SP2 Update 6, due to a password hashing method that employs a static, hardcoded salt shared among all users and installations, combined with an inadequate number of iterations. This flaw could enable an attacker to efficiently recover user passwords through brute-force or precomputed attacks, potentially leading to unauthorized access.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts by allowing attackers to recover hashed passwords and bypass authentication.

Remediation

Users are advised to update to Siemens SINEC INS V1.0 SP2 Update 6 or a later version. For more information, visit the Siemens Industry Support page.