CVE-2024-41794: Critical Hardcoded Credentials in Siemens PAC1260

CVE-2024-41794 is a critical (CVSS 10.0) hardcoded credentials flaw in the Siemens SENTRON 7KT PAC1260 Data Manager. All versions contain root level credentials for remote access if the SSH service is enabled. Siemens plans no fix and recommends replacing the device with the PAC1261.

What's affected

Per Siemens advisory SSA-187636:

• Affected: SENTRON 7KT PAC1260 Data Manager, all versions.
• Fix: none planned. Siemens says software fixes can no longer be provided for this device.
• Recommended action: replace it with the SENTRON 7KT PAC1261 Data Manager and update to the latest firmware.

The advisory covers nine CVEs for the device. For this one, an unauthenticated remote attacker gains full access if they hold the credentials and the SSH service is enabled, for example through CVE-2024-41793, a separate issue in the same advisory.

How to check if you're exposed

Check whether you own any SENTRON 7KT PAC1260 Data Managers. They sit in energy monitoring cabinets, so ask facilities and operations teams as well as IT.

For each device, check whether SSH is enabled and which networks can reach the device on port 22. From a host on the same network, a simple connection test shows whether the port answers:

nc -vz DEVICE-IP 22

Replace DEVICE-IP with the address. If the port answers from a network that is not a tightly controlled management segment, treat the device as exposed.

What to do now

1. Make a list of every PAC1260 in service and where it connects to the network.
2. Plan replacement with the PAC1261, and update its firmware to the latest version as Siemens advises.
3. Until replaced, make sure the device is not reachable from the internet or from general office networks.
4. Disable SSH on the device if it is enabled and not needed.
5. Follow Siemens' general industrial security recommendations, including a protected IT environment with firewalls.

Why it matters

The class is CWE-798, use of hard-coded credentials. A password built into firmware is the same on every unit and cannot be changed by the owner. Anyone who learns it can log in to every device, and the advisory says the account is root.

The score of 10.0 reflects a network attack that needs no privileges and no user interaction, with a changed scope. The condition is the SSH service being enabled. End-of-life devices like this are a recurring problem in building and industrial systems. When a vendor stops issuing fixes, isolation and replacement are the only paths, and a current asset list is how you find them.

Quick check

Sources

• Siemens advisory SSA-187636

Last reviewed: 19 October 2026.