CVE-2024-41794

critical · 10

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793).

CVSS

0.6%

EPSS (exploit prob.)

48th

EPSS percentile

2025-04-08

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
siemens	7kt_pac1260_data_manager_firmware	all versions
siemens	7kt_pac1260_data_manager	all versions

Check a specific version with /api/v1/cve/match.

References

https://cert-portal.siemens.com/productcert/html/ssa-187636.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-41794