Legacy Siemens SENTRON 7KM PAC3200 energy monitoring devices were impacted by a newly discovered critical flaw involving a four-digit PIN without brute-force attack protections, tracked as CVE-2024-41798, according to SC Media.
Siemens disclosed that threat actors with Modbus TCP interface access could infiltrate the vulnerable devices, which were last supported in 2019, not only via brute-force intrusions but also through device communications monitoring.
Despite being required to modify device settings, values, and parameters, as well as remove data and memory content, the PIN for SENTRON 7KM PAC3200 was only intended as a defense against unintended operating errors, according to Siemens' FAQ page on the end-of-life product.
Siemens urged organizations leveraging the vulnerable power measuring devices to immediately upgrade to SENTRON 7KM PAC3220, which features administrative write access deactivation and other brute-force attack defense capabilities.
