Privilege Escalation Vulnerability in SiPass Integrated Systems by Siemens
CVE-2025-27494
9.4CRITICAL
Key Information:
- Vendor
Siemens
- Vendor
- CVE Published:
- 11 March 2025
What is CVE-2025-27494?
A significant vulnerability exists in the SiPass Integrated AC5102 and ACC-AP systems. This flaw arises from improper input sanitization for the pubkey endpoint of the REST API, enabling an authenticated remote administrator to escalate privileges. By injecting arbitrary commands, attackers could execute them with root privileges, potentially compromising the entire system. Prompt updates to version 6.4.9 or later are recommended to mitigate this risk. For further details, refer to Siemens Security Advisory.
Affected Version(s)
SiPass integrated AC5102 (ACC-G2) 0
SiPass integrated ACC-AP 0