CVE-2024-41790: A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the...
9.1
CVSS
Description
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Classification
CVE ID: CVE-2024-41790
CVSS Base Severity: CRITICAL
CVSS Base Score: 9.1
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Problem Types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected Products
Vendor: Siemens
Product: SENTRON 7KT PAC1260 Data Manager
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.27% (probability of being exploited)
EPSS Percentile: 50.2% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-41790https://cert-portal.siemens.com/productcert/html/ssa-187636.html