CVE-2024-41796

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). The web interface of affected devices allows to change the login password without knowing the current password. In combination with a prepared CSRF attack (CVE-2024-41795) an unauthenticated attacker could be able to set the password to an attacker-controlled value.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-620

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-417974.3A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All CVE-2024-417989.8A vulnerability has been identified in SENTRON 7KM PAC3200 (All versions). Affected devices only provide a 4-digit PIN to protect from admin CVE-2024-417999.9tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" priv CVE-2024-41809.1The Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering some views via AJAX.CVE-2024-418007.5Craft is a content management system (CMS). Craft CMS 5 allows reuse of TOTP tokens multiple times within the validity period. An attacker i CVE-2024-418016.1OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of CVE-2024-418028.1Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Fi CVE-2024-418034.9Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Fi CVE-2024-418046.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Add CVE-2024-418056.1Tracks, a Getting Things Done (GTD) web application, is vulnerable to reflected cross-site scripting in versions prior to 2.7.1. Reflected c CVE-2024-418065.3The Open edX Platform is a learning management platform. Instructors can upload csv files containing learner information to create cohorts i CVE-2024-418085.4The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log.