Paper/Archive/CVE-2024-41789

CVE-2024-41789

Siemens SENTRON 7KT PAC1260 Data Manager — A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions).

EPSS 0.9%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 60.0.600 × 2012.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

Affected

ProductAffectedFixed inSource

SENTRON 7KT PAC1260 Data Managerall versions–CNA

Scores by source

siemens (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

siemens (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-187636.html