CVE-2024-41789

CRITICAL

SENTRON 7KT PAC1260 Data Manager - Authenticated Remote Code Execution via Language Parameter

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the language parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

References (1)

Core 1

Scores

CVSS v3 9.1
EPSS 0.0055
EPSS Percentile 68.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-78
Status published
Products (1)
siemens/7kt_pac1260_data_manager_firmware
Published Apr 08, 2025
Tracked Since Feb 18, 2026