OTPulse
FeedAboutContact

Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager

Act Now10SSA-187636Apr 8, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities including OS command injection (CWE-78), missing authentication (CWE-306), path traversal (CWE-22), hardcoded credentials (CWE-798), cross-site request forgery (CWE-352), and missing authorization checks (CWE-620). These flaws allow unauthenticated remote attackers to execute arbitrary commands, read sensitive files, and modify system behavior. The device is no longer supported with software updates; Siemens recommends replacement with the SENTRON 7KT PAC1261 Data Manager. Until replacement, network access must be restricted using firewalls and segmentation.

What this means
What could happen
An attacker with network access could execute arbitrary code on the SENTRON 7KT PAC1260, potentially allowing them to read or modify electrical metering and power distribution data, or disrupt monitoring and billing systems used by the utility.
Who's at risk
Water utilities and electric utilities relying on SENTRON 7KT PAC1260 Data Manager for metering, power monitoring, and distribution management. This device is used in electrical substations, data centers, and industrial facilities where accurate electrical data and system availability are critical to operations.
How it could be exploited
An attacker on the network sends a malicious request to the device without requiring valid credentials. The device fails to validate the request due to missing input validation (CWE-78 OS command injection, CWE-22 path traversal) and hardcoded credentials (CWE-798). This allows arbitrary commands to be executed on the data manager with full system privileges.
Prerequisites
  • Network access to the SENTRON 7KT PAC1260 Data Manager
  • No authentication or valid credentials required
Remotely exploitableNo authentication requiredLow complexity attackNo patch availableAffects metering and monitoring systems
Exploitability
Moderate exploit probability (EPSS 1.0%)
Affected products (1)
ProductAffected VersionsFix Status
SENTRON 7KT PAC1260 Data ManagerAll versionsNo fix (EOL)
Remediation & Mitigation
0/4
Do now
0/2
HOTFIXReplace SENTRON 7KT PAC1260 Data Manager with SENTRON 7KT PAC1261 Data Manager and update to the latest available firmware version
WORKAROUNDRestrict network access to the SENTRON 7KT PAC1260 using firewall rules, network segmentation, or access control lists to limit connections to authorized administrative networks only
Mitigations - no patch available
0/2
SENTRON 7KT PAC1260 Data Manager has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement defense-in-depth network architecture with the device isolated from untrusted networks and internet access
HARDENINGFollow Siemens operational guidelines for Industrial Security to configure the broader IT/OT environment
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/a28bf3a3-f885-47c6-8662-2c04c6acfaee