Sign-up

ID

VAR-202505-1587


CVE

CVE-2025-26389


TITLE

Siemens OZW Web Server Code Execution and SQL Injection Vulnerabilities (CNVD-2025-10579)

Trust: 0.6

sources: CNVD: CNVD-2025-10579

DESCRIPTION

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. OZW devices (web servers) are used to remotely monitor building controller devices, for example for monitoring heating controls or air conditioning conditions. Siemens OZW672 and OZW772 web servers have code execution and SQL injection vulnerabilities that can be exploited by an attacker to execute arbitrary code on the device with root privileges (in versions prior to V8.0) or authenticate as an administrator user (in versions prior to V6.0)

Trust: 1.44

sources: NVD: CVE-2025-26389 // CNVD: CNVD-2025-10579

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-10579

AFFECTED PRODUCTS

vendor:siemensmodel:ozw772scope:ltversion:5.2

Trust: 0.6

vendor:siemensmodel:ozw672scope:ltversion:v8.0

Trust: 0.6

vendor:siemensmodel:ozw672scope:ltversion:v6.0

Trust: 0.6

sources: CNVD: CNVD-2025-10579

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2025-26389
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2025-10579
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-10579
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

productcert@siemens.com: CVE-2025-26389
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-10579 // NVD: CVE-2025-26389

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

sources: NVD: CVE-2025-26389

EXTERNAL IDS

db:NVDid:CVE-2025-26389

Trust: 1.6

db:SIEMENSid:SSA-047424

Trust: 1.6

db:CNVDid:CNVD-2025-10579

Trust: 0.6

sources: CNVD: CNVD-2025-10579 // NVD: CVE-2025-26389

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-047424.html

Trust: 1.6

sources: CNVD: CNVD-2025-10579 // NVD: CVE-2025-26389

SOURCES

db:CNVDid:CNVD-2025-10579
db:NVDid:CVE-2025-26389

LAST UPDATE DATE

2025-05-31T22:47:12.410000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-10579date:2025-05-23T00:00:00
db:NVDid:CVE-2025-26389date:2025-05-13T19:35:18.080

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-10579date:2025-05-13T00:00:00
db:NVDid:CVE-2025-26389date:2025-05-13T10:15:23.513