Siemens OZW Web Servers
Advisory ansehen veröffentlicht 2025-05-13
OZW672 and OZW772 Web Server versions contain vulnerabilities that could allow an attacker to execute arbitrary code on the device with root privileges (in versions before V8.0) or to authenticate as Administrator user (in versions before V6.0). Siemens has released new versions for the affected products and recommends to update to the latest versions.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-26390US | — | — | ||
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking… | ||||
| CVE-2025-26389US | critical9.8 | — | ||
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters requir… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-047424: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers - CSAF Versionself
- SSA-047424: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers - HTML Versionself
- ICS Advisory ICSA-25-135-10 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-25-135-10 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
Behebungen (4)
- BehobenOZW672
Update to V6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/62567396/ - BehobenOZW672
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/62564534/ - BehobenOZW772
Update to V6.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/62564534/ - BehobenOZW772
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/62564534/
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan