CVE-2024-41792: Siemens 7KT PAC1260 Path Traversal Flaw

CVE-2024-41792 Overview

CVE-2024-41792 is a path traversal vulnerability [CWE-22] affecting all versions of the Siemens SENTRON 7KT PAC1260 Data Manager. The web interface of affected devices fails to properly validate user-supplied file paths. An unauthenticated remote attacker can exploit this flaw to read arbitrary files on the device with root privileges. The SENTRON 7KT PAC1260 Data Manager is used in industrial power monitoring environments, making this exposure relevant to operational technology (OT) deployments.

Critical Impact
Unauthenticated remote attackers can read arbitrary files with root privileges on affected SENTRON 7KT PAC1260 Data Manager devices, exposing credentials, configuration, and sensitive operational data.

Affected Products

Siemens SENTRON 7KT PAC1260 Data Manager (all hardware versions)
Siemens SENTRON 7KT PAC1260 Data Manager Firmware (all versions)
Power monitoring deployments using the affected device

Discovery Timeline

2025-04-08 - CVE-2024-41792 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41792

Vulnerability Analysis

The vulnerability resides in the web interface of the SENTRON 7KT PAC1260 Data Manager. The interface accepts file path input from HTTP requests without sufficient canonicalization or sanitization. An attacker can supply traversal sequences such as ../ to escape the intended document root and reference arbitrary files on the underlying filesystem.

Because the web service runs with root privileges, any file readable by the operating system is reachable through the traversal. This includes shadow files, network configuration, device certificates, and application-specific credential stores. No authentication is required, and the attack is performed over the network against the device's HTTP interface.

Siemens has not announced a fix in the referenced advisory. Network exposure of the device's management interface is therefore the primary determinant of risk.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The web application constructs filesystem paths from request parameters and passes them to file-read operations without verifying that the resolved path remains within an allowed directory. Combined with the absence of authentication on the affected endpoint and the root execution context of the web service, this turns a single crafted request into a privileged arbitrary file read.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who can reach the device's web interface sends an HTTP request containing relative path traversal sequences in a vulnerable parameter. The server resolves the path outside the web root and returns the contents of the requested file. Targets in flat industrial networks or devices exposed to the internet are at elevated risk.

No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.5%.

Detection Methods for CVE-2024-41792

Indicators of Compromise

HTTP requests to the device web interface containing ../, ..%2f, or encoded traversal sequences in query strings or path components
Unusual outbound traffic from the device or unexpected HTTP 200 OK responses returning large file content
Access patterns targeting sensitive filesystem locations such as /etc/passwd, /etc/shadow, or configuration directories
Repeated probing of the web interface from external or unmanaged network segments

Detection Strategies

Inspect HTTP traffic to SENTRON 7KT PAC1260 Data Manager devices for path traversal patterns using IDS/IPS signatures
Correlate web access logs from the device, where available, with network flow records to identify file enumeration activity
Baseline normal management traffic to the device and alert on requests originating from unexpected hosts

Monitoring Recommendations

Forward network traffic logs covering the OT segment to a centralized logging or SIEM platform for traversal pattern matching
Monitor for new or unexpected sessions reaching the device's HTTP port from IT networks, jump hosts, or external sources
Track configuration drift and unexpected reboots that could indicate post-exploitation activity

How to Mitigate CVE-2024-41792

Immediate Actions Required

Restrict network access to the SENTRON 7KT PAC1260 Data Manager web interface to trusted engineering workstations only
Place affected devices behind a firewall and block all inbound HTTP/HTTPS from untrusted networks
Segment OT networks from IT networks following IEC 62443 zone and conduit guidance
Review the Siemens Security Advisory SSA-187636 for vendor-specific guidance

Patch Information

Refer to the Siemens ProductCERT advisory SSA-187636 for the current remediation status. At the time of publication, all versions of the SENTRON 7KT PAC1260 Data Manager firmware are listed as affected. Apply any vendor-provided firmware update as soon as it becomes available.

Workarounds

Disable remote access to the device's web interface where operationally feasible
Enforce strict access control lists on switches and firewalls limiting reachability of the device's HTTP service
Use VPN or jump host architectures to mediate all administrative access to the device
Monitor device traffic for traversal patterns and alert on access attempts from unauthorized sources

bash

# Example: restrict access to the device web interface using iptables on an upstream gateway
# Replace 192.0.2.10 with the device IP and 10.0.50.0/24 with the trusted engineering subnet
iptables -A FORWARD -p tcp -s 10.0.50.0/24 -d 192.0.2.10 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP