CVE-2024-21483

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-12 · updated 2026-06-17
Weakness: CWE-284

Description

A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data.

Affected products

Siemens SENTRON 7KM PAC3120 AC/DC: from V3.2.3 before V3.2.4 — fixed in V3.2.4
Siemens SENTRON 7KM PAC3120 DC: from V3.2.3 before V3.2.4 — fixed in V3.2.4
Siemens SENTRON 7KM PAC3220 AC/DC: from V3.2.3 before V3.2.4 — fixed in V3.2.4
Siemens SENTRON 7KM PAC3220 DC: from V3.2.3 before V3.2.4 — fixed in V3.2.4

How to fix

Upgrade to a fixed version: Siemens SENTRON 7KM PAC3120 AC/DC V3.2.4; Siemens SENTRON 7KM PAC3120 DC V3.2.4; Siemens SENTRON 7KM PAC3220 AC/DC V3.2.4; Siemens SENTRON 7KM PAC3220 DC V3.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21483 or the next vulnerability affects your stack