CVE-2024-41788

CRITICAL

SENTRON 7KT PAC1260 Data Manager - Authenticated Remote Code Execution via GET Request Parameter Injection

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

References (1)

Core 1

Scores

CVSS v3 9.1
EPSS 0.0066
EPSS Percentile 71.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
siemens/7kt_pac1260_data_manager_firmware
Published Apr 08, 2025
Tracked Since Feb 18, 2026