CVE-2025-27494

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27494
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/html/ssa-515903.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*
History

22 Aug 2025, 17:49

Type Values Removed Values Added
CPE cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*
First Time Siemens sipass Integrated Ac5102 \(acc-g2\) Firmware
Siemens sipass Integrated Ac5102 \(acc-g2\)
Siemens sipass Integrated Acc-ap Firmware
Siemens sipass Integrated Acc-ap
Siemens
CWE NVD-CWE-noinfo
References () https://cert-portal.siemens.com/productcert/html/ssa-515903.html - () https://cert-portal.siemens.com/productcert/html/ssa-515903.html - Vendor Advisory
Summary
  • (es) Se ha identificado una vulnerabilidad en SiPass integrated AC5102 (ACC-G2) (Todas las versiones &lt; V6.4.9), SiPass integrated ACC-AP (Todas las versiones &lt; V6.4.9). Los dispositivos afectados depuran incorrectamente la entrada para el endpoint de clave pública de la API REST. Esto podría permitir que un administrador remoto autenticado aumente los privilegios mediante la inyección de comandos arbitrarios que se ejecutan con privilegios de superusuario.

11 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 10:15

Updated : 2025-08-22 17:49

NVD link : CVE-2025-27494

Mitre link : CVE-2025-27494

CVE.ORG link : CVE-2025-27494

JSON object : View

Products Affected

siemens

  • sipass_integrated_acc-ap
  • sipass_integrated_acc-ap_firmware
  • sipass_integrated_ac5102_\(acc-g2\)_firmware
  • sipass_integrated_ac5102_\(acc-g2\)
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo