Critical severity10.0NVD Advisory· Published May 13, 2025· Updated Jun 17, 2026

CVE-2025-26389

Description

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the exportDiagramPage endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siemens Foundation/Ozw672 Firmware
cpe:2.3:o:siemens:ozw672_firmware:*:*:*:*:*:*:*:*
Range: <8.0
Siemens Foundation/Ozw772 Firmware
cpe:2.3:o:siemens:ozw772_firmware:*:*:*:*:*:*:*:*
Range: <8.0
Siemens Foundation/OZW772llm-fuzzy2 versions
<V8.0+ 1 more
- (no CPE)range: <V8.0
- (no CPE)range: 0
Siemens Foundation/OZW672llm-fuzzy2 versions
<V8.0+ 1 more
- (no CPE)range: <V8.0
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

cert-portal.siemens.com/productcert/html/ssa-047424.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000