cnvd - cnvd-2025-10580

cnvd-2025-10580

Vulnerability from cnvd

Title: Siemens OZW Web Servers代码执行和SQL注入漏洞

Description:

OZW设备（Web服务器）用于远程监控楼宇控制器设备，例如用于监控供暖控制或空调状况。

Siemens OZW672和OZW772 Web服务器存在代码执行和SQL注入漏洞，攻击者可利用漏洞以root权限（在V8.0之前的版本中）在设备上执行任意代码，或以管理员用户身份进行身份验证（在V6.0之前的版本中）。

Severity: 高

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://cert-portal.siemens.com/productcert/html/ssa-047424.html

Reference: https://cert-portal.siemens.com/productcert/html/ssa-047424.html

Impacted products

Name
['Siemens OZW672', 'Siemens OZW772 <8.0', 'Siemens OZW772 <6.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-26390"
    }
  },
  "description": "OZW\u8bbe\u5907\uff08Web\u670d\u52a1\u5668\uff09\u7528\u4e8e\u8fdc\u7a0b\u76d1\u63a7\u697c\u5b87\u63a7\u5236\u5668\u8bbe\u5907\uff0c\u4f8b\u5982\u7528\u4e8e\u76d1\u63a7\u4f9b\u6696\u63a7\u5236\u6216\u7a7a\u8c03\u72b6\u51b5\u3002\n\nSiemens OZW672\u548cOZW772 Web\u670d\u52a1\u5668\u5b58\u5728\u4ee3\u7801\u6267\u884c\u548cSQL\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u4ee5root\u6743\u9650\uff08\u5728V8.0\u4e4b\u524d\u7684\u7248\u672c\u4e2d\uff09\u5728\u8bbe\u5907\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u6216\u4ee5\u7ba1\u7406\u5458\u7528\u6237\u8eab\u4efd\u8fdb\u884c\u8eab\u4efd\u9a8c\u8bc1\uff08\u5728V6.0\u4e4b\u524d\u7684\u7248\u672c\u4e2d\uff09\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-047424.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-10580",
  "openTime": "2025-05-13",
  "products": {
    "product": [
      "Siemens OZW672",
      "Siemens OZW772 \u003c8.0",
      "Siemens OZW772 \u003c6.0"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-047424.html",
  "serverity": "\u9ad8",
  "submitTime": "2025-05-13",
  "title": "Siemens OZW Web Servers\u4ee3\u7801\u6267\u884c\u548cSQL\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2025-26390 (GCVE-0-2025-26390)

Vulnerability from cvelistv5

Published

2025-05-13 09:38

Modified

2025-05-13 18:56

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Summary

A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as Administrator user.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/html/ssa-047424.html

Impacted products

Vendor

Product

Version

▼

Siemens

OZW672

Version: 0 < V6.0

Siemens

OZW772

Version: 0 < V6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26390",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-13T18:52:29.706609Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-13T18:56:33.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OZW672",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "OZW772",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V6.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in OZW672 (All versions \u003c V6.0), OZW772 (All versions \u003c V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as\r\nAdministrator user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-13T09:38:35.749Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-047424.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2025-26390",
    "datePublished": "2025-05-13T09:38:35.749Z",
    "dateReserved": "2025-02-07T15:33:59.767Z",
    "dateUpdated": "2025-05-13T18:56:33.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted