CVE-2025-26389 is a critical (CVSS 10.0) OS command injection flaw in the Siemens OZW672 and OZW772 web servers. An unauthenticated remote attacker could run arbitrary code with root privileges through the exportDiagramPage endpoint. Siemens fixes it in V8.0, so update every affected device and restrict network access.
What's affected
- Products: Siemens OZW672 and OZW772 web servers, used for remote monitoring of building controllers such as heating control and air conditioning.
- Affected: all versions before V8.0, per Siemens ProductCERT advisory SSA-047424.
- Fixed: V8.0 or later. Siemens links the downloads from its support pages for each product.
- Related: the same advisory covers CVE-2025-26390, a SQL injection in authentication data checking that could let an unauthenticated attacker authenticate as Administrator, affecting versions before V6.0.
- Vector: network reachable, no login, no user interaction, and changed scope, which is how it reaches 10.0.
How to check if you're exposed
Find the firmware version in the device's web interface or documentation, and compare it with V8.0. If you manage buildings with several sites, collect versions from each one, since these devices tend to be installed by contractors and not tracked centrally.
Then look at exposure. The most important question is whether any OZW web server is reachable from the internet or from a general business network.
nmap -Pn -p 80,443 <your-public-range>
Scan only your own addresses. If any device answers, treat it as high priority. Also ask your building services contractor whether remote access was set up through a port forward. If you find one, remove it before you do anything else.
What to do now
- Update OZW672 and OZW772 devices to V8.0 or later, using the downloads linked from Siemens' advisory.
- Remove any direct internet exposure and any port forward to the web server, and put remote access behind a VPN.
- Segment building control devices from business networks and from each other, following Siemens' general security recommendations.
- Read SSA-047424 in full, because it covers the SQL injection issue CVE-2025-26390 as well.
- After the update, change the administrator password and review who has access to the device.
- Keep an inventory of these devices with owner, location and firmware version.
Why it matters
The weakness is OS command injection. The web service does not sanitise the input parameters for the exportDiagramPage endpoint, so crafted input can end up in a command the device runs as root.
- CWE-78 is improper neutralization of special elements in an operating system command. Input is placed into a command string that the system then runs, so the caller can add commands of their own.
Building management gear is often forgotten in security programmes. The devices are small, the people who install them are not IT staff, and the firmware rarely gets touched after commissioning. Yet a root level, unauthenticated flaw gives access to a network segment that may also connect to other building systems. Siemens recommends protecting network access to affected products and running them in a protected IT environment, which is the right framing: patch, but also remove the path an outsider would use. Our record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog.
Try it yourself
Devices outside the usual IT inventory are where advisories slip through. This demo shows how a watch on new advisories keeps them visible.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-26389?
V8.0 or later for both OZW672 and OZW772, according to Siemens' advisory SSA-047424.
Is there a second flaw in the same advisory?
Yes. CVE-2025-26390 is a SQL injection in authentication checks, affecting versions before V6.0. Updating to V8.0 covers both.
Sources
Last reviewed: 19 October 2026.
