Read the docs
TI-2024-14242 Aliases CVE-2024-21483GHSA-cc9x-2646-xv35

Improper access control in Siemens SENTRON 7KM PAC3120 AC/DC

Priority LOW 23CWE-284Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00223 13th percentileScored 2026-11-07
Fix Fixed SENTRON 7KM PAC3120 AC/DC (Siemens): V3.2.4SENTRON 7KM PAC3120 DC (Siemens): V3.2.4+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSENTRON 7KM PAC3120 AC/DCV3.2.3 to before V3.2.4V3.2.4Patch availableCNA
SiemensSENTRON 7KM PAC3120 DCV3.2.3 to before V3.2.4V3.2.4Patch availableCNA
SiemensSENTRON 7KM PAC3220 AC/DCV3.2.3 to before V3.2.4V3.2.4Patch availableCNA
SiemensSENTRON 7KM PAC3220 DCV3.2.3 to before V3.2.4V3.2.4Patch availableCNA
  • SENTRON 7KM PAC3120 AC/DC VendorSiemens Affected V3.2.3 to before V3.2.4 Fixed in V3.2.4 Patch available CNA
  • SENTRON 7KM PAC3120 DC VendorSiemens Affected V3.2.3 to before V3.2.4 Fixed in V3.2.4 Patch available CNA
  • SENTRON 7KM PAC3220 AC/DC VendorSiemens Affected V3.2.3 to before V3.2.4 Fixed in V3.2.4 Patch available CNA
  • SENTRON 7KM PAC3220 DC VendorSiemens Affected V3.2.3 to before V3.2.4 Fixed in V3.2.4 Patch available CNA

Remediation

  • Fix · CNA SENTRON 7KM PAC3120 AC/DC (Siemens) Fixed in V3.2.4
  • Fix · CNA SENTRON 7KM PAC3120 DC (Siemens) Fixed in V3.2.4
  • Fix · CNA SENTRON 7KM PAC3220 AC/DC (Siemens) Fixed in V3.2.4
  • Fix · CNA SENTRON 7KM PAC3220 DC (Siemens) Fixed in V3.2.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21483
  2. 2026-10-03 Alias added: GHSA-cc9x-2646-xv35

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences