OS command injection in Siemens OZW672
Priority MEDIUM 51CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0098 62nd percentileScored 2026-11-07
Fix Fixed OZW672 (Siemens): V8.0OZW772 (Siemens): V8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | OZW672 | before V8.0 | V8.0 | Patch available | CNA |
| Siemens | OZW772 | before V8.0 | V8.0 | Patch available | CNA |
- OZW672 VendorSiemens Affected before V8.0 Fixed in V8.0 Patch available CNA
- OZW772 VendorSiemens Affected before V8.0 Fixed in V8.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:ozw672_firmware:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ozw672:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:ozw772_firmware:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ozw772:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:ozw672_firmware:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ozw672:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:ozw772_firmware:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ozw772:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA OZW672 (Siemens) Fixed in V8.0
- Fix · CNA OZW772 (Siemens) Fixed in V8.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-26389
- 2026-10-03 Alias added: GHSA-mhmm-4g6x-6p5g
References
More Siemens Ozw672 Firmware vulnerabilities
- TI-2025-19349 SQL injection in Siemens OZW672 CVSS 4.0CRITICAL 9.3
- TI-2024-23964 Cross-site scripting in Siemens OZW672 CVSS 4.0HIGH 8.2
- TI-2019-10394 A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All… CVSS 3.1HIGH 7.5
- TI-2017-04610 Missing authentication in OZW672, OZW772 CVSS 3.0HIGH 7.4
- TI-2017-04609 Missing authentication in OZW672, OZW772 CVSS 3.0MEDIUM 6.5
- TI-2016-01375 Cross-site scripting (XSS) vulnerability in the login form in the integrated web server… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2025-26389 · CVE Program
- CVE-2025-26389 · NVD
- FIRST EPSS
- GHSA-mhmm-4g6x-6p5g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences