CVE-2024-41793: Siemens 7KT PAC1260 Auth Bypass Flaw

CVE-2024-41793 Overview

CVE-2024-41793 affects the Siemens SENTRON 7KT PAC1260 Data Manager across all firmware versions. The web interface exposes an endpoint that enables the Secure Shell (SSH) service without requiring authentication. An unauthenticated remote attacker can invoke this endpoint over the network to activate SSH on the device.

Once SSH is enabled, the attacker gains a persistent remote access channel to the industrial device. The flaw is classified under CWE-306: Missing Authentication for Critical Function and carries a CVSS v4.0 base score of 7.7.

Critical Impact
Unauthenticated remote attackers can enable SSH on affected SENTRON 7KT PAC1260 Data Manager devices, exposing an interactive remote access channel on industrial power monitoring equipment.

Affected Products

Siemens SENTRON 7KT PAC1260 Data Manager (all firmware versions)
Siemens SENTRON 7KT PAC1260 Data Manager hardware appliance
All deployments exposing the device web interface to reachable network segments

Discovery Timeline

2025-04-08 - CVE-2024-41793 published to the National Vulnerability Database (NVD)
2025-04-08 - Siemens ProductCERT publishes advisory SSA-187636
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41793

Vulnerability Analysis

The SENTRON 7KT PAC1260 Data Manager is an industrial data acquisition device used to collect and consolidate energy metering data from SENTRON power monitoring devices. It exposes a web interface for configuration and administration.

The web interface implements an endpoint intended to toggle the SSH service state on the device. This endpoint does not enforce authentication before executing the requested action. Any network-reachable client can issue the request and turn on the SSH daemon.

Enabling SSH transforms the device from a monitoring appliance into an interactive Linux-style target. Attackers can then attempt credential brute force, exploit default credentials, or pivot further into operational technology (OT) network segments.

Root Cause

The root cause is a missing authentication check on a state-changing administrative endpoint [CWE-306]. The web interface handler for enabling SSH does not validate a session token, credentials, or other authorization context before processing the request. This is a common failure pattern in embedded and industrial device firmware where administrative functions are assumed to be reachable only from trusted networks.

Attack Vector

The attack vector is network-based and requires no privileges, no user interaction, and no prior foothold. The Siemens advisory notes that these devices are declared end-of-life and should be operated only in trusted environments. In many deployments, the web interface is reachable from adjacent OT or IT segments, making the endpoint accessible to any attacker who reaches the device's HTTP service.

An attacker sends an HTTP request to the unauthenticated endpoint that enables the SSH service. Following a successful response, SSH becomes reachable on the standard TCP port. The attacker then proceeds with credential-based access attempts. Specific request paths and parameters are documented in the Siemens advisory referenced above.

Detection Methods for CVE-2024-41793

Indicators of Compromise

Unexpected TCP port 22 (SSH) listening on SENTRON 7KT PAC1260 Data Manager devices that previously had SSH disabled
HTTP requests to the device's web management interface from unexpected source addresses, especially requests targeting SSH enable functionality
New successful or failed SSH authentication attempts appearing in perimeter or OT network logs directed at PAC1260 devices
Outbound connections initiated by the device to non-standard destinations following interactive SSH sessions

Detection Strategies

Perform periodic network scans of OT segments to enumerate open TCP/22 on PAC1260 IP addresses and alert on state changes
Correlate web interface access logs with subsequent SSH service availability changes on the same device
Deploy passive OT network monitoring to flag SSH protocol traffic on segments where it is not part of the baseline
Baseline device configuration through periodic administrative polling and alert on unexpected service state transitions

Monitoring Recommendations

Log all HTTP requests to the PAC1260 web interface at the network firewall or reverse proxy tier for retrospective analysis
Monitor authentication events, session establishment, and command execution on any SSH service exposed by industrial devices
Alert on any device configuration change events that enable network services on SENTRON equipment
Aggregate device telemetry, firewall logs, and OT sensor data in a centralized SIEM or data lake for cross-source correlation

How to Mitigate CVE-2024-41793

Immediate Actions Required

Restrict network access to the SENTRON 7KT PAC1260 Data Manager web interface to authorized management hosts only, using firewall or ACL enforcement
Place affected devices behind a segmented OT network with no direct exposure to corporate IT or the internet
Verify the current state of the SSH service on every deployed PAC1260 device and disable it if not required for operations
Review firewall and switch logs for prior unauthorized access attempts to the device web interface

Patch Information

Siemens has not published a firmware fix for this vulnerability. According to Siemens Security Advisory SSA-187636, the SENTRON 7KT PAC1260 Data Manager is out of support. Siemens recommends decommissioning affected devices and migrating to a currently supported product line. Consult the Siemens advisory for current guidance and replacement product options.

Workarounds

Deploy the device only inside a trusted network protected by strict perimeter controls, as recommended by Siemens
Block inbound HTTP and TCP/22 traffic to the device from all networks except a dedicated management VLAN
Enforce host-based ACLs at the upstream switch or firewall to permit management traffic only from known administrator workstations
Plan and execute migration to a supported Siemens data manager product to eliminate the exposure at its source