CVE-2024-41788: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the...
9.1
CVSS
Description
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the input parameters in specific GET requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Classification
CVE ID: CVE-2024-41788
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Problem Types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected Products
Vendor: Siemens
Product: SENTRON 7KT PAC1260 Data Manager
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.27% (probability of being exploited)
EPSS Percentile: 50.2% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-41788https://cert-portal.siemens.com/productcert/html/ssa-187636.html