PT-2025-20852 · Ozw772+1 · Ozw772+1

Published 2025-05-13 · Updated 2025-05-18 · CVE-2025-26389

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OZW672 versions prior to V8.0 OZW772 versions prior to V8.0

Description: A vulnerability has been identified where the web service in affected devices does not sanitize the input parameters required for the exportDiagramPage endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Recommendations: For OZW672 versions prior to V8.0, update to version V8.0 or later to resolve the issue. For OZW772 versions prior to V8.0, update to version V8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the exportDiagramPage endpoint until a patch is available.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-06523

CVE-2025-26389

Affected Products

Ozw672

Ozw772

References · 8

• https://bdu.fstec.ru/vul/2025-06523 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-047424.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26389 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26389 · Vendor Advisory
• https://twitter.com/cracbot/status/1924057489445884414 · Twitter Post
• https://twitter.com/Carlos_LopezMkt/status/1924059288399446175 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922336745317605688 · Twitter Post
• https://twitter.com/CVEnew/status/1922228941806260365 · Twitter Post