PT-2025-20853 · Ozw772+1 · Ozw772+1

Published 2025-05-13 · Updated 2025-05-13 · CVE-2025-26390

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: OZW672 versions prior to V6.0 OZW772 versions prior to V6.0

Description: A vulnerability has been identified in the web service of affected devices, making it vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as an Administrator user.

Recommendations: For OZW672 versions prior to V6.0, update to version V6.0 or later to resolve the issue. For OZW772 versions prior to V6.0, update to version V6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the web service to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-06524

CVE-2025-26390

Affected Products

Ozw672

Ozw772

References · 6

• https://osv.dev/vulnerability/CVE-2025-26390 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06524 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-047424.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26390 · Security Note
• https://twitter.com/VulmonFeeds/status/1922344423137939628 · Twitter Post
• https://twitter.com/CVEnew/status/1922228940963283325 · Twitter Post