CVE-2019-13941 Information disclosure in OZW672

What is CVE-2019-13941?

CVE-2019-13941 is a high-severity vulnerability in Siemens AG OZW672, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system.

Weakness: CWE-552

Which versions are affected by CVE-2019-13941?

It affects 2 products.

Products include Siemens Ozw672 Firmware, Siemens Ozw772 Firmware.

How do I fix CVE-2019-13941?

No fix has been published for CVE-2019-13941 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-13941 being exploited?

There is no known exploitation of CVE-2019-13941 in the wild and no public exploit code.

Other vulnerabilities in Siemens AG OZW672

• CVE-2025-26389 Command injection in OZW672 Critical 10.0
• CVE-2025-26390 SQL injection in OZW672 Critical 9.3
• CVE-2024-36140 Cross-site scripting in OZW672 High 8.2
• CVE-2017-6873 Security feature bypass in OZW672, OZW772 High 7.4
• CVE-2017-6872 Missing authorization in OZW672, OZW772 Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-738g-h857-xx48.