CVE-2025-26390: Siemens OZW672 Firmware SQLi Vulnerability

CVE-2025-26390 Overview

A critical SQL injection vulnerability has been identified in Siemens OZW672 and OZW772 web gateway devices running firmware versions prior to V6.0. The web service of affected devices is vulnerable to SQL injection when checking authentication data, allowing an unauthenticated remote attacker to bypass authentication checks and gain Administrator-level access to the device.

Critical Impact

This authentication bypass vulnerability allows remote attackers to completely compromise affected Siemens building automation web gateways without requiring any credentials, potentially gaining full administrative control over connected building management systems.

Affected Products

• Siemens OZW672 (All firmware versions < V6.0)
• Siemens OZW672 Firmware
• Siemens OZW772 (All firmware versions < V6.0)
• Siemens OZW772 Firmware

Discovery Timeline

• 2025-05-13 - CVE-2025-26390 published to NVD
• 2025-10-03 - Last updated in NVD database

Technical Details for CVE-2025-26390

Vulnerability Analysis

This vulnerability (CWE-89: SQL Injection) exists in the authentication mechanism of the web service on Siemens OZW672 and OZW772 devices. The affected firmware fails to properly sanitize user-supplied input during the authentication process, allowing attackers to inject malicious SQL statements that manipulate the underlying database queries.

The authentication bypass enables unauthenticated remote attackers to gain Administrator-level privileges on the device. OZW672 and OZW772 devices serve as web gateways for building automation systems, meaning successful exploitation could provide attackers with control over connected HVAC, lighting, and other building management infrastructure.

The network-accessible nature of this vulnerability, combined with no required privileges or user interaction, makes it particularly dangerous for organizations with internet-exposed devices or inadequate network segmentation.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the authentication verification function of the web service. User-supplied credentials are incorporated into SQL queries without adequate escaping or parameterization, enabling SQL injection attacks that can manipulate the authentication logic to return successful results regardless of the actual credentials provided.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the web service authentication endpoint. By injecting SQL syntax into the username or password fields, an attacker can manipulate the authentication query to bypass credential verification entirely.

The exploitation flow involves:

1. Attacker identifies an exposed OZW672 or OZW772 device web interface
2. Attacker crafts a malicious authentication request containing SQL injection payload
3. The vulnerable web service incorporates the payload into the authentication SQL query
4. The manipulated query bypasses authentication validation
5. Attacker receives Administrator session credentials and full device access

For technical details and specific exploitation patterns, refer to the Siemens Security Advisory SSA-047424.

Detection Methods for CVE-2025-26390

Indicators of Compromise

• Unusual authentication log entries showing successful Administrator logins from unexpected IP addresses or geographic locations
• HTTP access logs containing suspicious characters in authentication parameters such as single quotes, SQL keywords (OR, AND, UNION, SELECT), or encoded variants
• Multiple rapid authentication attempts followed by successful Administrator access
• Unexpected configuration changes to building automation systems or device settings

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection patterns in authentication requests
• Implement network intrusion detection system (IDS) signatures for SQL injection attempts targeting Siemens OZW devices
• Monitor authentication logs for anomalous Administrator login patterns or logins from unauthorized networks
• Review HTTP traffic logs for requests containing SQL metacharacters or injection patterns in POST data

Monitoring Recommendations

• Enable verbose logging on OZW672/OZW772 devices and forward logs to a centralized SIEM for correlation analysis
• Set up alerts for Administrator authentication events from external or untrusted networks
• Implement network traffic analysis to identify connections to device web interfaces from unauthorized sources
• Regularly audit device configurations for unauthorized changes that may indicate post-exploitation activity

How to Mitigate CVE-2025-26390

Immediate Actions Required

• Update affected OZW672 and OZW772 devices to firmware version V6.0 or later immediately
• Isolate affected devices from external network access until patching is complete
• Review authentication logs for evidence of compromise or exploitation attempts
• Implement network segmentation to restrict access to building automation systems to authorized management networks only

Patch Information

Siemens has released firmware version V6.0 for both OZW672 and OZW772 devices that addresses this SQL injection vulnerability. Organizations should obtain the patched firmware directly from Siemens and follow the vendor's upgrade procedures. Refer to the Siemens Security Advisory SSA-047424 for detailed patch information and download links.

Workarounds

• Restrict network access to the device web interface using firewall rules to allow only trusted management IP addresses
• Place OZW672/OZW772 devices behind a VPN and disable direct internet exposure
• Implement a web application firewall in front of the device to filter SQL injection attempts
• Disable web interface access entirely if not operationally required until patches can be applied

# Example firewall rule to restrict access to OZW device web interface
# Allow only specific management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Alternative: Block all external access to device management interface
iptables -A INPUT -p tcp --dport 80 -i eth0 -j DROP
iptables -A INPUT -p tcp --dport 443 -i eth0 -j DROP