PT-2025-15386 · Senron · Senron 7Kt Pac1260 Data Manager

Published 2025-04-08 · Updated 2025-04-08 · CVE-2024-41788

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SENRON 7KT PAC1260 Data Manager (All versions)

Description: A vulnerability has been identified in the web interface of affected devices, where input parameters in specific GET requests are not sanitized. This could allow an authenticated remote attacker to execute arbitrary code with root privileges.

Recommendations: Update the software to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid using the vulnerable web interface until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-04011

CVE-2024-41788

Affected Products

Senron 7Kt Pac1260 Data Manager

References · 7

• https://cert-portal.siemens.com/productcert/html/ssa-187636.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41788 · Security Note
• https://securityvulnerability.io/vulnerability/CVE-2024-41788 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-187636.pdf · Note
• https://twitter.com/CveFindCom/status/1909525126707556769 · Twitter Post
• https://twitter.com/CVEnew/status/1909528275548094703 · Twitter Post