CVE-2025-26390criticalCWE-89

CVE-2025-26390: critical vulnerability in Siemens OZW672

Published

Follow this CVE+ Monitor OZW672+ Monitor OZW772

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.6%
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as Administrator user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Siemens · OZW672Siemens · OZW772
Related CVEs — Siemens OZW672

In the same product, most dangerous first.

CVE-2025-26389CRITICALCVE-2025-26389EPSS 1.0%CVE-2024-36140HIGHCVE-2024-36140EPSS 0.3%