CVE-2025-27494: Siemens Sipass Privilege Escalation Flaw

CVE-2025-27494 Overview

CVE-2025-27494 is a command injection vulnerability affecting Siemens SiPass integrated access control devices. The flaw resides in the pubkey endpoint of the REST API, which fails to sanitize user-supplied input. An authenticated remote administrator can inject arbitrary operating system commands that execute with root privileges on the affected controller. Siemens published advisory SSA-515903 on March 11, 2025 to address the issue in firmware versions prior to V6.4.9. The vulnerability is tracked under [CWE-20] (Improper Input Validation) and carries a CVSS 4.0 score of 9.4.

Critical Impact

Authenticated administrators can execute arbitrary commands as root, leading to full compromise of SiPass access control devices that govern physical security.

Affected Products

• Siemens SiPass integrated AC5102 (ACC-G2) — all versions before V6.4.9
• Siemens SiPass integrated ACC-AP — all versions before V6.4.9
• Associated firmware for both AC5102 (ACC-G2) and ACC-AP controllers

Discovery Timeline

• 2025-03-11 - CVE-2025-27494 published to NVD and Siemens advisory SSA-515903 released
• 2025-08-22 - Last updated in NVD database

Technical Details for CVE-2025-27494

Vulnerability Analysis

The SiPass integrated AC5102 (ACC-G2) and ACC-AP are network-connected access control units used in enterprise physical security deployments. Both devices expose a REST API for administrative configuration. The pubkey endpoint accepts data that is later passed to an underlying shell or system call. Because input is not sanitized or validated, an attacker can append shell metacharacters and additional commands to the supplied parameter. The injected commands execute under the root account that runs the API service. This converts an administrative privilege into full operating system control over the controller, including read/write access to credential stores, door schedules, and audit logs.

Root Cause

The root cause is improper neutralization of special elements in input passed to the pubkey REST API endpoint [CWE-20]. The handler concatenates attacker-controlled values into a command string without escaping shell metacharacters or using a parameterized execution interface. As a result, characters such as ;, |, &, and backticks are interpreted by the shell.

Attack Vector

Exploitation requires network reachability to the device REST API and valid administrator credentials. After authenticating, the attacker issues a crafted HTTP request to the pubkey endpoint containing a command-injection payload embedded in a public key parameter. The device parses the payload, invokes the underlying shell, and executes the appended commands with root privileges. No user interaction is needed. The attacker gains persistent control of the controller and can pivot into adjacent operational technology networks.

No public proof-of-concept code is available. See the Siemens Security Advisory SSA-515903 for vendor-confirmed technical details.

Detection Methods for CVE-2025-27494

Indicators of Compromise

• Unexpected HTTP requests targeting the pubkey REST API endpoint on SiPass controllers, particularly with payloads containing shell metacharacters such as ;, |, &&, or backticks.
• New or unfamiliar processes spawned by the SiPass API service, including shells (/bin/sh, /bin/bash), network utilities (wget, curl, nc), or scripting interpreters running as root.
• Outbound network connections originating from SiPass devices to unknown external hosts.
• Modifications to system binaries, cron entries, or startup scripts on the controller filesystem.

Detection Strategies

• Inspect API gateway and firewall logs for POST or PUT requests to pubkey containing non-standard characters outside the expected public key format.
• Correlate administrator authentication events with subsequent API calls to identify abnormal session activity from administrative accounts.
• Compare firmware versions across the SiPass fleet against V6.4.9 to identify unpatched devices exposed to the flaw.

Monitoring Recommendations

• Forward SiPass device logs and surrounding network telemetry into a centralized SIEM for retention and correlation.
• Alert on any administrative login to SiPass controllers from sources outside an approved management subnet.
• Baseline normal REST API traffic volumes and flag deviations that could indicate enumeration or exploitation attempts.

How to Mitigate CVE-2025-27494

Immediate Actions Required

• Upgrade SiPass integrated AC5102 (ACC-G2) and ACC-AP firmware to V6.4.9 or later as directed by Siemens advisory SSA-515903.
• Restrict REST API reachability to a dedicated, segmented management VLAN accessible only to authorized administrators.
• Rotate all SiPass administrator credentials and audit account inventories to remove unused or shared accounts.
• Review recent administrative activity and API logs for signs of prior exploitation on devices that remained unpatched.

Patch Information

Siemens addressed the vulnerability in firmware version V6.4.9 for both SiPass integrated AC5102 (ACC-G2) and ACC-AP. Refer to the Siemens Security Advisory SSA-515903 for download instructions and firmware integrity verification details.

Workarounds

• If immediate patching is not possible, place the affected controllers behind a firewall that blocks all inbound traffic except from a hardened jump host.
• Disable or restrict administrator accounts that are not actively required for daily operations to reduce the attack surface.
• Apply the defense-in-depth guidance in Siemens operational security recommendations for industrial control environments.

# Example firewall rule restricting SiPass REST API access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP