Remote Code Execution Vulnerability in Siemens OZW672 and OZW772 Products
CVE-2025-26389

10CRITICAL

Key Information:

Vendor

Siemens
Status
Ozw672
Ozw772
Vendor
CVE Published:
13 May 2025

What is CVE-2025-26389?

A significant input validation vulnerability has been found in Siemens OZW672 and OZW772 products, specifically affecting all versions below V8.0. The flaw resides in the web service's exportDiagramPage endpoint, which inadequately sanitizes input parameters. This lack of validation can be exploited by an unauthenticated remote attacker, potentially allowing them to execute arbitrary code with root privileges, raising serious security concerns for users of these devices.

Affected Version(s)

OZW672 0

OZW772 0

References

https://cert-portal.siemens.com/productcert/html/ssa-0474...

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.