SINEC INS EUVD-2026-35384

Exploitation requires a valid low-privilege authenticated session on SINEC INS, as indicated by PR:L in the CVSS 4.0 vector. The attacker must have network-level access to the SINEC INS management API (AV:N), which is typical in environments where the application is deployed as a network management server. No user interaction (UI:N) and no special attack conditions (AC:L, AT:N) are required beyond the authenticated session. Exploitation is limited to confidentiality disclosure (VC:L); the attacker cannot write files or alter system state through this vector. The vulnerability is constrained to versions below V1.0 SP2 Update 6 - systems running the patched release are not affected.

The CVSS 4.0 base score of 5.3 (Medium) is consistent with the constrained impact profile: AV:N confirms network reachability, AC:L and AT:N indicate no special attack conditions or target prerequisites, but PR:L mandates that the attacker hold valid low-privilege credentials, meaningfully limiting the exposure surface. The impact metrics (VC:L, VI:N, VA:N, SC:N, SI:N, SA:N) confirm read-only, limited confidentiality disclosure with no integrity or availability consequence. This is not a Critical-tier issue despite network attack vector. The vulnerability is not listed in the CISA KEV catalog and no EPSS score was provided in the source data, leaving exploitation probability unquantified. In ICS/OT environments, however, even limited file read access to a network management server like SINEC INS may expose sensitive configuration data, credentials stored in config files, or network topology details that elevate attacker situational awareness for follow-on attacks. Risk should be assessed higher in environments where SINEC INS credentials are broadly shared or where the application stores sensitive operational data on disk.

An attacker with a valid low-privilege account on SINEC INS submits a crafted GET request to /api/sftp/uploadFiles with a path parameter containing '../' sequences, such as '../../etc/passwd' or traversal strings targeting SINEC INS configuration directories. The server processes the unsanitized path and returns directory listings or file contents from outside the intended SFTP root. No public proof-of-concept has been identified at time of analysis, but the technique is well-understood and trivially constructible from the description alone.