Paper/Archive/CVE-2024-41788

CVE-2024-41788

Siemens SENTRON 7KT PAC1260 Data Manager — A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).

EPSS 0.9%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 60.0.600 × 2012.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

Affected

ProductAffectedFixed inSource

SENTRON 7KT PAC1260 Data Managerall versions–CNA

Scores by source

siemens (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

siemens (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-187636.html