VDB
CVE-2025-26389
CVE-2025-26389
PUBLISHED
CVSS 10 CRITICAL
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
EPSS 0.98% · 62.1th percentile
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.98%
62.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| siemens | ozw772_firmware | 0 |
| siemens | ozw672_firmware | 0 |
| Siemens | OZW772 | 0 |
| Siemens | OZW672 | 0 |
Timeline
- Feb 7, 2025 CVE ID Reserved
- May 13, 2025 EPSS Score
- May 13, 2025 CVE Published
- May 13, 2025 CVE Updated
- May 15, 2025 PoC Published
- May 25, 2025 EPSS Score
- May 31, 2025 Coalition ESS Score
- Jun 7, 2025 EPSS Score
- Jun 19, 2025 EPSS Score
- Jul 2, 2025 EPSS Score
- Jul 14, 2025 EPSS Score
- Jul 26, 2025 EPSS Score