Privilege Escalation Vulnerability in SiPass Integrated Systems by Siemens

CVE-2025-27494

What is CVE-2025-27494?

A significant vulnerability exists in the SiPass Integrated AC5102 and ACC-AP systems. This flaw arises from improper input sanitization for the pubkey endpoint of the REST API, enabling an authenticated remote administrator to escalate privileges. By injecting arbitrary commands, attackers could execute them with root privileges, potentially compromising the entire system. Prompt updates to version 6.4.9 or later are recommended to mitigate this risk. For further details, refer to Siemens Security Advisory.

References