Siemens OZW672 Firmware vulnerabilities

7 CVEs affecting Siemens OZW672 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-26390, published 2025-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-13941, published 2020-02-11. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that…
CVE-2016-1488, published 2016-01-30. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject…
CVE-2017-6873, published 2017-08-08. High severity, CVSS 7.4. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle…
CVE-2025-26389, published 2025-05-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the input parameters required for the…
CVE-2017-6872, published 2017-08-08. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was discovered in Siemens OZW672 (all versions) and OZW772 (all versions) that could allow an attacker with access to port 21/tcp to access or alter historical measurement data stored…
CVE-2025-26390, published 2025-05-13. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL injection when checking authentication…
CVE-2024-36140, published 2024-11-12. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices is vulnerable to stored cross-site scripting (XSS)…