SQL Injection Vulnerability in OZW672 and OZW772 Devices by Siemens

CVE-2025-26390

What is CVE-2025-26390?

A significant vulnerability has been discovered in the OZW672 and OZW772 devices by Siemens, specifically in all versions prior to V6.0. The affected web services of these devices exhibit SQL injection flaws during authentication processes. This alarming weakness could enable an unauthenticated remote adversary to bypass authentication checks, potentially gaining unauthorized administrative access. Organizations using these devices should prioritize immediate assessment and remediation to ensure system integrity and protect against exploitation.

References