CVE-2024-41796CWE-620

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions)

Medium · published April 8, 2025

CVSS v4.0
6.9
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-620 · Unverified Password Change
Published
2025-04-08T08:22Z
EPSS history
Timeline
  • 08 APR 08:22Z
    A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions)
    cvelistv5