Siemens OZW Web Server RCE and SQLi Vulnerabilities (CVE-2025-26389/26390)

Critical Vulnerability Information Vulnerability Overview Advisory Number: SSA-047424 Title: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers Release Date: 2025-05-13 CVSS v3.1 Base Score: 10.0 CVSS v4.0 Base Score: 10.0 Affected Products and Versions OZW672: Versions below V8.0 OZW772: Versions below V6.0 Vulnerability Description 1. CVE-2025-26389 - Description: The web service in affected devices does not sanitize input parameters required for the endpoint, allowing unauthenticated remote attackers to execute arbitrary code with root privileges. - CVSS v3.1 Base Score: 10.0 - CVSS v4.0 Base Score: 10.0 - CWE: CWE-78: Improper Neutralization of Special Elements Used in OS Commands ('OS Command Injection') 2. CVE-2025-26390 - Description: The web service in affected devices is vulnerable to SQL injection attacks during authentication data validation, enabling unauthenticated remote attackers to bypass checks and authenticate as an administrator user. - CVSS v3.1 Base Score: 9.8 - CVSS v4.0 Base Score: 9.8 - CWE: CWE-89: Improper Neutralization of Special Elements Used in SQL Commands ('SQL Injection') Solutions and Mitigations Siemens has released updated versions for the affected products; users are advised to upgrade to the latest versions. Specific mitigations or workarounds can be found in the "Affected Products and Solutions" section. Security Recommendations It is strongly recommended to implement appropriate mechanisms to protect network access to affected products. Follow recommended security practices and operate devices within a protected IT environment.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens OZW Web Server RCE and SQLi Vulnerabilities (CVE-2025-26389/26390)