Siemens SINEC INS versions before 1.0 SP2 Update 6 use a password hashing implementation that employs a static, hardcoded salt shared across all users and installations, combined with an insufficient iteration count. This cryptographic weakness (CWE-760) allows attackers to perform efficient brute-force or precomputed attacks to recover user passwords. The vulnerability can lead to unauthorized access with high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available to address this issue.

The vulnerability allows attackers with local access (attack vector: local) and high privileges to recover user passwords due to weak password hashing. Successful exploitation can result in complete compromise of user accounts, impacting confidentiality, integrity, and availability of the system. The CVSS vector indicates high attack complexity and required privileges, but no user interaction is needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should minimize exposure by restricting local access and monitoring for suspicious activity. Avoid relying solely on the affected password hashing mechanism for authentication security.