Siemens SENTRON 7KT PAC1260 Data Manager Arbitrary Code Execution Vulnerability

A vulnerability exists in the SENTRON 7KT PAC1260 Data Manager, all versions, due to the web interface failing to properly sanitize input parameters in certain GET requests. This flaw could enable an authenticated remote attacker to execute arbitrary code with root privileges on the affected device.

Impact

Exploitation of this vulnerability allows for arbitrary code execution with root privileges on the affected device.

Remediation

Siemens no longer provides software fixes for the SENTRON 7KT PAC1260 Data Manager. Users are advised to replace the device with the SENTRON 7KT PAC1261 Data Manager and update to the latest available firmware version. The new model 7KT1261 is available through the Siemens Industry Mall.