Siemens SENTRON 7KT PAC1260 Data Manager Path Traversal Vulnerability

A path traversal vulnerability has been identified in the Siemens SENTRON 7KT PAC1260 Data Manager, affecting all versions. The vulnerability resides in the web interface of the device, where improper input validation allows an unauthenticated attacker to access arbitrary files on the device with root privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the device, potentially allowing for further exploitation or manipulation of the device's functionality.

Remediation

Siemens no longer provides software fixes for the SENTRON 7KT PAC1260 Data Manager. Users are advised to replace the device with the SENTRON 7KT PAC1261 Data Manager and update to the latest available firmware version. The new model 7KT1261 is available through the Siemens Industry Mall.