Siemens OZW772
Approved changes feed: RSS · Atom
cpe:2.3:h:siemens:ozw772:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Siemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f) |
|---|---|
| Product | Ozw772 (6d3c1067-6bbb-5983-bd2f-8015dcb19541) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-26390 |
not_vulnerable | 2026-06-08 07:12:51.583638 |
Details available
CRITICAL (9.8)
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as
Administrator user.
Published: 2025-05-13T09:38:35.749Z
Updated: 2025-05-13T18:56:33.539Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26389 |
not_vulnerable | 2026-06-08 07:12:51.582706 |
Details available
CRITICAL (10)
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Published: 2025-05-13T09:38:34.471Z
Updated: 2025-05-13T18:58:21.917Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36140 |
not_vulnerable | 2026-06-08 06:39:43.748971 |
Details available
MEDIUM (6.8)
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks.
This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.
Published: 2024-11-12T12:49:32.130Z
Updated: 2024-11-12T14:35:44.207Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36140 |
vulnerable | 2026-06-08 06:39:43.744807 |
Details available
MEDIUM (6.8)
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks.
This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.
Published: 2024-11-12T12:49:32.130Z
Updated: 2024-11-12T14:35:44.207Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13941 |
not_vulnerable | 2026-06-08 05:12:52.643923 |
Details available
A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system.
Published: 2020-02-11T15:36:10.000Z
Updated: 2024-08-05T00:05:43.901Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-6873 |
not_vulnerable | 2026-06-08 05:09:55.090756 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-6872 |
not_vulnerable | 2026-06-08 05:09:55.089187 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-1488 |
not_vulnerable | 2026-06-08 05:07:31.531684 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.