CVE-2025-26389: Siemens OZW672 Firmware RCE Vulnerability

CVE-2025-26389 Overview

A critical command injection vulnerability has been identified in Siemens OZW672 and OZW772 web server building controllers. The web service in affected devices fails to properly sanitize input parameters required for the exportDiagramPage endpoint, allowing an unauthenticated remote attacker to execute arbitrary code with root privileges.

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw is particularly severe as it requires no authentication, enabling any network-accessible attacker to achieve complete system compromise.

Critical Impact

Unauthenticated remote attackers can execute arbitrary commands with root privileges on affected Siemens building automation controllers, potentially compromising critical infrastructure systems.

Affected Products

• Siemens OZW672 Firmware (All versions < V8.0)
• Siemens OZW672 Hardware
• Siemens OZW772 Firmware (All versions < V8.0)
• Siemens OZW772 Hardware

Discovery Timeline

• 2025-05-13 - CVE-2025-26389 published to NVD
• 2025-10-06 - Last updated in NVD database

Technical Details for CVE-2025-26389

Vulnerability Analysis

The vulnerability resides in the web service component of Siemens OZW672 and OZW772 building controllers. These devices are industrial IoT (IIoT) controllers used for building automation and HVAC system management. The exportDiagramPage endpoint accepts user-supplied input parameters that are passed directly to operating system commands without proper sanitization or validation.

The lack of input validation in this endpoint creates a direct path for command injection. Since the web service operates with root privileges, any injected commands inherit these elevated permissions, granting attackers complete control over the affected device.

Root Cause

The root cause is improper neutralization of special elements used in OS commands (CWE-78). The exportDiagramPage function fails to validate, sanitize, or escape user-controlled input before incorporating it into shell commands executed by the underlying operating system. This represents a fundamental failure in secure coding practices, specifically the absence of input validation and output encoding at a critical security boundary.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable exportDiagramPage endpoint. The attack flow involves:

1. Attacker identifies an exposed OZW672 or OZW772 controller accessible via the network
2. Attacker crafts a malicious HTTP request targeting the exportDiagramPage endpoint
3. Malicious payload containing OS commands is injected through unsanitized input parameters
4. The web service executes the injected commands with root privileges
5. Attacker achieves arbitrary code execution and full system compromise

The exploitation mechanism involves injecting shell metacharacters (such as ;, |, &&, or backticks) within the endpoint parameters to break out of the intended command context and execute attacker-controlled commands. For technical details, refer to the Siemens Security Advisory SSA-047424.

Detection Methods for CVE-2025-26389

Indicators of Compromise

• Unusual HTTP requests to the exportDiagramPage endpoint containing shell metacharacters (;, |, &&, `, $())
• Unexpected outbound network connections from OZW672/OZW772 devices
• Anomalous process execution or shell spawning on the building controller
• Unauthorized changes to device configuration or firmware

Detection Strategies

• Deploy network intrusion detection systems (IDS) with signatures for command injection patterns targeting the exportDiagramPage endpoint
• Monitor HTTP access logs for requests containing shell metacharacters or encoded injection payloads
• Implement web application firewalls (WAF) to filter malicious input patterns before reaching the vulnerable endpoint
• Utilize SentinelOne Singularity XDR for endpoint-level detection of anomalous process execution on network-connected IIoT devices

Monitoring Recommendations

• Enable detailed logging on OZW672/OZW772 devices and forward logs to a centralized SIEM
• Monitor for unexpected root-level process execution on affected controllers
• Track network traffic patterns to and from building automation controllers for anomalies
• Implement network segmentation monitoring to detect lateral movement attempts from compromised devices

How to Mitigate CVE-2025-26389

Immediate Actions Required

• Update all affected OZW672 and OZW772 devices to firmware version V8.0 or later immediately
• Restrict network access to building controllers by placing them behind firewalls and limiting access to authorized management systems only
• Disable remote access to affected devices until patching is complete
• Conduct security assessments to identify any exposed OZW672/OZW772 devices in your environment

Patch Information

Siemens has released firmware version V8.0 for both OZW672 and OZW772 devices to address this vulnerability. Organizations should prioritize applying this update across all affected deployments. Detailed patch information and download links are available in the Siemens Security Advisory SSA-047424.

Workarounds

• Implement strict network segmentation to isolate OZW672/OZW772 controllers from untrusted networks
• Deploy a web application firewall (WAF) or reverse proxy to filter malicious requests targeting the exportDiagramPage endpoint
• Restrict access to the web interface using VPN or allowlist-based IP filtering
• Disable the web service entirely if not required for operations until patching can be completed

# Network segmentation example using iptables
# Restrict access to OZW device web interface (port 443/80) to management network only
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP