PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-41794 Siemens CVE debrief

CVE-2024-41794 affects Siemens SENTRON 7KT PAC1260 Data Manager devices that contain hardcoded credentials for remote access to the device operating system with root privileges. If an attacker has those credentials and SSH is enabled, they may gain full access to the device. The advisory is rated CVSS 10.0/CRITICAL, and Siemens currently reports that no fix is planned.

Vendor
Siemens
Product
SENTRON 7KT PAC1260 Data Manager
CVSS
CRITICAL 10
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-08
Original CVE updated
2025-04-08
Advisory published
2025-04-08
Advisory updated
2025-04-08

Who should care

Siemens SENTRON 7KT PAC1260 operators, OT/ICS asset owners, plant engineers, and defenders responsible for remote access control and network segmentation.

Technical summary

The source advisory states that affected devices expose hardcoded credentials usable for remote OS access as root. The attack vector is network-based and requires no user interaction. The practical impact is complete compromise of confidentiality, integrity, and availability if the credentials are known and SSH is reachable. The advisory also notes the issue may be reachable when SSH is enabled, including via exploitation of CVE-2024-41793.

Defensive priority

Immediate

Recommended defensive actions

  • Inventory all Siemens SENTRON 7KT PAC1260 Data Manager deployments and confirm whether SSH is enabled.
  • Restrict SSH to trusted management networks only; block it from untrusted or flat networks.
  • Strengthen OT network segmentation and remove direct exposure of the device to the internet or other nonessential networks.
  • Review whether any deployments could have used the hardcoded access path and treat exposed systems as high risk.
  • Monitor Siemens and CISA advisories for updates; Siemens currently lists no fix planned, so rely on compensating controls.

Evidence notes

This debrief is based only on the supplied CISA CSAF source and linked official references. The source published on 2025-04-08 describes hardcoded credentials for remote OS access with root privileges, states that full device access may result if the credentials are known and SSH is enabled, and lists no planned fix for the affected product. The CVSS vector provided is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-41794 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-41794

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-41794 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-41794

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-100-06.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-187636.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-187636.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-06

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.