CVE-2024-41790

critical · 9.4

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

9.4

CVSS

0.9%

EPSS (exploit prob.)

58th

EPSS percentile

2025-04-08

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
siemens	7kt_pac1260_data_manager_firmware	all versions
siemens	7kt_pac1260_data_manager	all versions

Check a specific version with /api/v1/cve/match.

References

https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-41790