Siemens reports critical flaw in SENTRON 7KM PAC3200 power measuring device
Take action: If you are using SENTRON 7KM PAC3200, make sure it's isolated from the internet and only accessible from trusted networks. Then plan to upgrade or replace it, because it's no longer supported.
Learn More
Siemens has disclosed a critical vulnerability in its SENTRON 7KM PAC3200 power measuring device.
The flaw is tracked as CVE-2024-41798 (CVSS score 9.3) allows an attacker to gain administrator access through brute-forcing a four-digit PIN, making it possible to exploit the device remotely. The SENTRON 7KM PAC3200, which was discontinued in 2019, is protected only by a four-digit PIN that can be brute-forced easily because there are just 10,000 possible combinations. An attacker could systematically try every combination until the correct PIN is found, gaining full administrative access.
The Modbus TCP interface used by the PAC3200 is a particular point of vulnerability, as it communicates in cleartext without encryption. This means that a malicious actor who intercepts these communications could potentially sniff out the PIN without having to brute-force it.
Given that the SENTRON 7KM PAC3200 has no planned security patches (as it is an end-of-life product), Siemens advises users to:
- Restrict network access to these devices.
- Follow industrial security guidelines provided by Siemens to minimize exposure
- Consider upgrading to the SENTRON 7KM PAC3220, the successor model, which offers improved security, including protection against brute-force attacks and disabled remote write access.
Users of the affected devices are urged to implement these precautions immediately, as the absence of a patch leaves the devices vulnerable to potential exploitation.
