by Kastro
Paper/Archive/CVE-2025-26390

CVE-2025-26390

Siemens OZW672 — A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0).

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.8.508 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as Administrator user.

Affected

ProductAffectedFixed inSource
OZW672< V6.0V6.0CNA
OZW772< V6.0V6.0CNA

Scores by source

siemens (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
siemens (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-047424.html