CVE-2024-41790: OS Command Injection
A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices does not sanitize the region parameter in specific POST requests. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41790?
CVE-2024-41790 is rated as critical due to its potential to allow authenticated remote attackers to execute arbitrary code with root privileges.
How do I fix CVE-2024-41790?
To fix CVE-2024-41790, ensure that you implement the latest security updates provided by Siemens for the SENTRON 7KT PAC1260 Data Manager.
Who is affected by CVE-2024-41790?
All versions of the Siemens SENTRON 7KT PAC1260 Data Manager are affected by CVE-2024-41790.
What is the nature of the vulnerability in CVE-2024-41790?
CVE-2024-41790 is caused by the lack of proper sanitization of the region parameter in the web interface of the device.
Can CVE-2024-41790 be exploited without authentication?
No, CVE-2024-41790 requires an authenticated user to exploit the vulnerability and execute arbitrary code.