Siemens SENTRON 7KT PAC1260 Data Manager Language Parameter OS Command Injection Vulnerability

A vulnerability exists in the Siemens SENTRON 7KT PAC1260 Data Manager, all versions, due to the web interface failing to properly sanitize the language parameter in certain POST requests. This flaw could enable an authenticated remote attacker to execute arbitrary code with root privileges on the affected device.

Impact

Exploitation of this vulnerability allows authenticated remote attackers to execute arbitrary code with root privileges on the affected device.

Remediation

Siemens no longer provides software fixes for the SENTRON 7KT PAC1260 Data Manager. Users are advised to replace the device with the SENTRON 7KT PAC1261 Data Manager and update to the latest available firmware version. The new model 7KT1261 is available through the Siemens Industry Mall.