CVE-2024-41795: Siemens 7KT PAC1260 CSRF Vulnerability

CVE-2024-41795 Overview

CVE-2024-41795 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting all versions of the Siemens SENTRON 7KT PAC1260 Data Manager. The web interface fails to validate the origin of state-changing requests. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in device administrator, modifies arbitrary device settings. The flaw carries a CVSS 4.0 base score of 6.9 and requires user interaction to exploit. Siemens published advisory SSA-187636 describing the issue and mitigations. The affected product is an energy monitoring gateway used in industrial and building automation environments, making unauthorized configuration changes a direct threat to operational technology (OT) reliability.

Critical Impact
A successful CSRF attack allows an unauthenticated remote adversary to alter device configuration by hijacking an administrator's authenticated session, potentially disrupting energy monitoring operations.

Affected Products

Siemens SENTRON 7KT PAC1260 Data Manager (all firmware versions)
Siemens SENTRON 7KT PAC1260 Data Manager hardware
All deployments exposing the device web interface to reachable networks

Discovery Timeline

2025-04-08 - CVE-2024-41795 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41795

Vulnerability Analysis

The SENTRON 7KT PAC1260 Data Manager exposes a web interface for administrator configuration of the energy data gateway. The interface accepts state-changing HTTP requests without validating that they originated from a legitimate, user-initiated action inside the application. This omission is the defining characteristic of a Cross-Site Request Forgery vulnerability [CWE-352].

An attacker cannot directly authenticate to the device without valid credentials. Instead, the attacker relies on an authenticated administrator's browser session. When the administrator visits a page controlled by the attacker while still logged into the device, the browser automatically attaches the session cookie to any request sent to the device. The device processes the request as legitimate.

Because the device sits in industrial and building automation networks, exploitation can modify metering configurations, communication parameters, or user accounts. This impacts integrity of the OT environment without directly compromising confidentiality or availability.

Root Cause

The root cause is the absence of anti-CSRF controls on the administrative web interface. The application does not require synchronizer tokens, verify the Origin or Referer headers, or enforce SameSite cookie attributes on session cookies. Any authenticated request the browser sends is trusted, regardless of where it was initiated.

Attack Vector

The attack requires network reachability to the device web interface and social engineering to induce the administrator to click a malicious link or load attacker-controlled content. The malicious page triggers a forged HTTP request, typically a form auto-submitted through JavaScript, targeting a sensitive configuration endpoint on the device. Technical details of vulnerable endpoints are described in the Siemens Security Advisory SSA-187636.

Detection Methods for CVE-2024-41795

Indicators of Compromise

Unexpected configuration changes on the 7KT PAC1260 Data Manager web interface, including modified user accounts, metering parameters, or network settings.
Web server logs on the device showing state-changing HTTP requests with Referer headers pointing to untrusted external domains.
Administrator browser history showing visits to unfamiliar sites immediately preceding device configuration changes.

Detection Strategies

Monitor HTTP traffic to the device management interface for POST requests originating from cross-origin contexts or missing expected referrer headers.
Correlate administrator workstation web browsing telemetry with configuration change events on the device.
Deploy network intrusion detection signatures that flag requests to known device endpoints when preceded by traffic to non-corporate domains.

Monitoring Recommendations

Enable audit logging on the 7KT PAC1260 web interface where supported and forward logs to a centralized SIEM.
Alert on any configuration change made outside approved maintenance windows.
Track administrator authentication sessions and correlate them with browser activity to detect potential CSRF exploitation attempts.

How to Mitigate CVE-2024-41795

Immediate Actions Required

Restrict access to the device web interface to a dedicated management network or VLAN, blocking direct exposure to user workstations and the internet.
Require administrators to close all other browser tabs and use a dedicated browser profile when managing the device.
Terminate active administrator sessions immediately after configuration tasks to reduce the window of exploitability.
Review recent device configuration state and audit logs for any unauthorized changes.

Patch Information

Siemens has not published a firmware fix for this issue at the time of the advisory. Consult the Siemens Security Advisory SSA-187636 for the latest remediation guidance and any subsequent firmware updates. Apply vendor-provided updates as soon as they become available.

Workarounds

Place the device behind a firewall that restricts access to the web interface using source IP allow-lists.
Use a jump host or privileged access workstation dedicated to OT management for all administrative sessions.
Log out of the device web interface immediately after completing administrative tasks and clear browser cookies.
Follow the operational guidelines in the Siemens Industrial Security handbook to reduce exposure of ICS components.

bash

# Example firewall restriction limiting web UI access to a dedicated management host
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.5 -d <device_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -d <device_ip> -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.5 -d <device_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -d <device_ip> -j DROP