Executive brief
The Siemens SENTRON 7KT PAC1261 Data Manager, a device used for energy monitoring and data management in critical infrastructure, contains a security flaw in its web server. An attacker could exploit this vulnerability to intercept sensitive authorization tokens, potentially gaining full administrative control over the device. This could lead to unauthorized configuration changes or disruption of energy monitoring operations.
Technical details
The vulnerability is an HTTP Request Smuggling flaw (CWE-444) originating from the Go Project's net/http package. The package improperly accepts a bare Line Feed (LF) as a line terminator in chunked data lines, which can lead to inconsistent interpretation of requests when the device is used in conjunction with another proxy or server. A remote, unauthenticated attacker can exploit this to smuggle requests, potentially capturing authorization tokens from other users' sessions. This allows for administrative account takeover and full control over the device's management interface. Siemens has addressed this in version V2.1.0.
Affected products
- Siemens SENTRON 7KT PAC1261 Data Manager Before V2.1.0
Timeline
- 2026-05-12: disclosed: Initial release by Siemens ProductCERT
- 2026-05-14: advisory: CISA republication of advisory ICSA-26-134-14
- 2026-05-12: patched: Siemens released version V2.1.0 to address the issue