CVE-2025-26389: A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not...
10.0
CVSS
Description
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Classification
CVE ID: CVE-2025-26389
CVSS Base Severity: CRITICAL
CVSS Base Score: 10.0
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Problem Types
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Affected Products
Vendor: Siemens
Product: OZW672, OZW772
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.28% (probability of being exploited)
EPSS Percentile: 51.09% (scored less or equal to compared to others)
EPSS Date: 2025-06-06 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-26389https://cert-portal.siemens.com/productcert/html/ssa-047424.html