Description
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | OZW672 | < V8.0 | V8.0 |
| Siemens | OZW772 | < V8.0 | V8.0 |
Advisories 3
- NCSC-2025-0160 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · May 14, 2025
- ICSA-25-135-10 Siemens OZW Web Servers CISA ICS & IT advisories · May 13, 2025
- SSA-047424 SSA-047424: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers Siemens ProductCERT · May 13, 2025