CVE-2026-46749 is a weak password hashing flaw in Siemens SINEC INS, scored CVSS 7.5 (high). The product uses one hardcoded salt for every user and too few iterations. Siemens says to update to V1.0 SP2 Update 6 or later, and to restrict network access to the device. That is the quotable fix.
What's affected
Siemens advisory SSA-860189 lists SINEC INS, all versions before V1.0 SP2 Update 6. The fix is V1.0 SP2 Update 6 or a later release. The advisory links to the Siemens support page for the download.
The vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. An attacker needs local access, high privileges and a hard to meet condition, which holds the score at 7.5.
How to check if you're exposed
- Open the SINEC INS web interface and find the installed version in the about or system information view.
- Compare it with V1.0 SP2 Update 6.
- If you are behind it, you are in the affected range.
Use the Siemens advisory for exact steps, since I am not stating product specific menus.
What to do now
- Install V1.0 SP2 Update 6 or later.
- Follow the Siemens guidance to protect network access to devices with appropriate mechanisms, and follow its industrial security operating guidelines.
- Treat passwords stored by the old version as exposed to offline cracking if an attacker could read the password store. Plan a reset of user passwords after the update.
- Do not reuse SINEC INS passwords elsewhere.
Siemens gives no CVE specific workaround.
Why it matters
The weakness is CWE-760, use of a one way hash with a predictable salt. A shared salt lets an attacker build precomputed tables that work against every user, and a low iteration count makes guessing fast. The record says this could allow recovery of passwords and unauthorized access.
The KEV flag is false and the advisory does not report exploitation.
Quick check
Can this be exploited remotely?
The vector shows local access and high privileges are required, so it is mainly a risk after another compromise or from an insider.
Sources
Last reviewed: 19 October 2026.
