Vulnerability · Published Apr 8, 2025 · Assigned by siemens

CVE-2024-41794

Critical 10.0

In plain English

A critical-severity hard-coded credentials in SENTRON 7KT PAC1260 Data Manager from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.6%top 49.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the device operating system with root privileges. This could allow unauthenticated remote attackers to gain full access to a device, if they are in possession of these credentials and if the ssh service is enabled (e.g., by exploitation of CVE-2024-41793).

Affected products (as reported)

Vendor	Product	Versions
Siemens	SENTRON 7KT PAC1260 Data Manager	0 – before *

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://cert-portal.siemens.com/productcert/html/ssa-187636.html