Approved changes feed: RSS · Atom
cpe:2.3:a:siemens:ozw772:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Siemens (4bd2a91b-02ad-5c3d-b25f-70697e0c9d7f) |
|---|---|
| Product | Ozw772 (6d3c1067-6bbb-5983-bd2f-8015dcb19541) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-26390 |
vulnerable | 2026-06-08 07:12:51.583306 |
Details available
CRITICAL (9.8)
A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication data. This could allow an unauthenticated remote attacker to bypass the check and authenticate as
Administrator user.
Published: 2025-05-13T09:38:35.749Z
Updated: 2025-05-13T18:56:33.539Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-26389 |
vulnerable | 2026-06-08 07:12:51.579391 |
Details available
CRITICAL (10)
A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the `exportDiagramPage` endpoint. This could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Published: 2025-05-13T09:38:34.471Z
Updated: 2025-05-13T18:58:21.917Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36140 |
vulnerable | 2026-06-08 06:39:43.746385 |
Details available
MEDIUM (6.8)
A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS) attacks.
This could allow an authenticated remote attacker to inject arbitrary JavaScript code that is later executed by another authenticated victim user with potential higher privileges than the attacker.
Published: 2024-11-12T12:49:32.130Z
Updated: 2024-11-12T14:35:44.207Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.