CVE-2025-26389

A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

• CWE-78

• https://cert-portal.siemens.com/productcert/html/ssa-047424.htmlVendor Advisory

Published

May 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2638A vulnerability, which was classified as problematic, was fo…5.3
• CVE-2025-26381Successful exploitation of this vulnerability could allow an…6.5
• CVE-2025-26382Under certain circumstances the iSTAR Configuration Utility …9.3
• CVE-2025-26383The iSTAR Configuration Utility (ICU) tool leaks memory, whi…6.3
• CVE-2025-26385Johnson Controls Metasys component listed below have Improp…9.5
• CVE-2025-26386Johnson Controls iSTAR Configuration Utility (ICU) has Stack…7.1
• CVE-2025-2639A vulnerability has been found in JIZHICMS up to 1.7.0 and c…5.3
• CVE-2025-26390A vulnerability has been identified in OZW672 (All versions …9.8
• CVE-2025-26391SolarWinds Observability Self-Hosted XSS Vulnerability. The …5.4
• CVE-2025-26392SolarWinds Observability Self-Hosted is susceptible to SQL i…4.6
• CVE-2025-26393SolarWinds Service Desk is affected by a broken access contr…5.4
• CVE-2025-26394SolarWinds Observability Self-Hosted is susceptible to an …4.8