CVE-2025-27494

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27494
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-515903.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*
History

22 Aug 2025, 17:49

Type Values Removed Values Added
Summary
  • (es) Se ha identificado una vulnerabilidad en SiPass integrated AC5102 (ACC-G2) (Todas las versiones &lt; V6.4.9), SiPass integrated ACC-AP (Todas las versiones &lt; V6.4.9). Los dispositivos afectados depuran incorrectamente la entrada para el endpoint de clave pública de la API REST. Esto podría permitir que un administrador remoto autenticado aumente los privilegios mediante la inyección de comandos arbitrarios que se ejecutan con privilegios de superusuario.
CWE NVD-CWE-noinfo
First Time Siemens sipass Integrated Ac5102 \(acc-g2\)
Siemens sipass Integrated Acc-ap Firmware
Siemens sipass Integrated Acc-ap
Siemens sipass Integrated Ac5102 \(acc-g2\) Firmware
Siemens
References () https://cert-portal.siemens.com/productcert/html/ssa-515903.html - () https://cert-portal.siemens.com/productcert/html/ssa-515903.html - Vendor Advisory
CPE cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*

11 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 10:15

Updated : 2025-08-22 17:49

NVD link : CVE-2025-27494

Mitre link : CVE-2025-27494

CVE.ORG link : CVE-2025-27494

JSON object : View

Products Affected

siemens

  • sipass_integrated_acc-ap
  • sipass_integrated_acc-ap_firmware
  • sipass_integrated_ac5102_\(acc-g2\)
  • sipass_integrated_ac5102_\(acc-g2\)_firmware
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo