CVE-2025-26389 Command injection in OZW672

What is CVE-2025-26389?

CVE-2025-26389 is a critical command injection vulnerability in Siemens OZW672, published on 13 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Weakness: CWE-78

Which versions are affected by CVE-2025-26389?

It affects 2 products.

Products include Siemens Ozw672 Firmware, Siemens Ozw772 Firmware.

How do I fix CVE-2025-26389?

No fix has been published for CVE-2025-26389 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-26389 being exploited?

There is no known exploitation of CVE-2025-26389 in the wild and no public exploit code.

Other vulnerabilities in Siemens OZW672

• CVE-2025-26390 SQL injection in OZW672 Critical 9.3
• CVE-2024-36140 Cross-site scripting in OZW672 High 8.2
• CVE-2019-13941 Information disclosure in OZW672 High 7.5
• CVE-2017-6873 Security feature bypass in OZW672, OZW772 High 7.4
• CVE-2017-6872 Missing authorization in OZW672, OZW772 Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mhmm-4g6x-6p5g.