CVE-2025-27494criticalCWE-20

CVE-2025-27494: critical vulnerability in Siemens SiPass integrated AC5102 (ACC-G2)

Published

Follow this CVE+ Monitor SiPass integrated AC5102+ Monitor SiPass integrated ACC-AP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.5%
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Siemens · SiPass integrated AC5102 (ACC-G2)Siemens · SiPass integrated ACC-AP
Related CVEs — Siemens SiPass integrated AC5102 (ACC-G2)

In the same product, most dangerous first.

CVE-2024-52285MEDIUMCVE-2024-52285EPSS 0.5%CVE-2022-31808HIGHCVE-2022-31808EPSS 0.2%CVE-2025-27493CRITICALCVE-2025-27493EPSS 0.2%