Description
A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from administrative access via Modbus TCP interface. Attackers with access to the Modbus TCP interface could easily bypass this protection by brute-force attacks or by sniffing the Modbus clear text communication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SENTRON 7KM PAC3200 | — | — |
Advisories 4
- NCSC-2024-0390 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Oct 8, 2024
- ICSA-24-284-04 Siemens SENTRON PAC3200 Devices CISA ICS & IT advisories · Oct 8, 2024
- SSA-850560 SSA-850560: Use of 4-Digit PIN in SENTRON PAC3200 Devices Siemens ProductCERT · Oct 8, 2024
- WID-SEC-2024-3099 Siemens Sentron PAC: Schwachstelle ermöglicht Erlangen von Administratorrechten BSI CERT-Bund (WID) · Oct 7, 2024