SINEC INS EUVD-2026-35386

Exploitation requires local access to the SINEC INS host (AV:L) with high privileges sufficient to read the application's password hash store (PR:H). The CVSS 4.0 vector also specifies AT:P, indicating specific deployment prerequisites must be present - likely that the application is configured with user accounts whose hashes are stored using the vulnerable implementation. The static salt is a global property of the application, so no special per-deployment misconfiguration is required beyond the application being installed in an affected version. Factors limiting exploitation: the attacker must already have high-privileged local access, meaning this vulnerability is not independently exploitable from the network; it functions as a credential escalation or persistence mechanism following initial access. Remote, unauthenticated exploitation is not supported by the CVSS vector. Specific non-default configurations are not required - the weak hashing appears to be the default implementation in all affected versions.

The CVSS 4.0 base score of 4.9 reflects significant attack constraints: AV:L (local access required), AC:H (high attack complexity), AT:P (specific prerequisites must be present), and PR:H (high privileges required to access the hash store). These preconditions sharply limit opportunistic exploitation. However, the subsequent system impact scores - SC:H, SI:H, SA:H - reveal the true downstream risk: once credentials are recovered, an attacker can achieve high-impact compromise of systems beyond the vulnerable host itself, which is consistent with SINEC INS's role as a network management platform with broad reach into industrial infrastructure. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified. The realistic risk profile is therefore: low probability of exploitation by opportunistic attackers due to the AV:L/PR:H barrier, but high severity for insider threats, post-breach lateral movement scenarios, or cases where a lower-severity initial access vulnerability is chained to reach the hash store. The 'Authentication Bypass' tag reflects the ultimate impact rather than the mechanism.

An insider or post-compromise attacker with high-privileged local access to a SINEC INS host extracts the application's password database. Because all installations share the same hardcoded salt, the attacker pre-computes a rainbow table offline (or runs a GPU-accelerated brute-force attack) and recovers plaintext credentials for multiple user accounts within a feasible timeframe. The recovered credentials are then used to log into SINEC INS with legitimate user identities, granting access to industrial network management capabilities and potentially enabling reconfiguration of connected infrastructure. No public POC has been identified, but the attack technique is well-understood and requires no novel research.