Input Validation Flaw in SENTRON 7KT PAC1260 Data Manager by Siemens
CVE-2024-41788

9.4CRITICAL

Key Information:

Vendor
Siemens
Status
Sentron 7kt Pac1260 Data Manager
Vendor
CVE Published:
8 April 2025

Summary

A significant input validation vulnerability has been discovered in the web interface of the SENTRON 7KT PAC1260 Data Manager by Siemens, which affects all versions. The issue arises from the failure to properly sanitize input parameters in certain GET requests. This flaw could potentially allow an authenticated remote attacker to execute arbitrary code with root privileges, posing a serious risk to the integrity and security of the affected systems.

Affected Version(s)

SENTRON 7KT PAC1260 Data Manager 0

References

https://cert-portal.siemens.com/productcert/html/ssa-1876...

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.