Siemens SENTRON 7KT PAC1260 Data Manager Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Siemens SENTRON 7KT PAC1260 Data Manager, affecting all versions. The issue arises in the web interface, where an unauthenticated attacker can manipulate device settings by deceiving a legitimate administrator into clicking a malicious link.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in device settings.

Remediation

Siemens no longer provides software fixes for the SENTRON 7KT PAC1260 Data Manager. Users are advised to replace the device with the SENTRON 7KT PAC1261 Data Manager and update to the latest firmware version. The new model is available through the Siemens Industry Mall.