The vulnerability arises from the use of a static, hard‑coded salt and a small number of hashing iterations in all versions of the Siemens SINEC INS application. This weak password‑hashing scheme allows an attacker to efficiently perform brute‑force or pre‑computed attacks to recover stored passwords. The primary impact is the potential compromise of user accounts, leading to unauthorized access to protected resources within the installation.

Siemens SINEC INS users of all versions below V1.0 SP2 Update 6 are vulnerable. The affected versions include every release older than the stated update.

The CVSS score of 5.0 classifies this as a moderate severity weakness. The EPSS score is not available, so the exact probability of exploitation is unknown, but the lack of mitigation makes brute‑force attacks feasible. This vulnerability is not listed in the CISA KEV catalog, suggesting no widespread best‑practice exploitation is currently documented. Since the weakness lies in the authentication processing, the likely attack vector is through the application’s login interface, potentially from remote or local users with access to the authentication system.