CVE-2025-27493

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

A

vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-515903.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*

History

22 Aug 2025, 17:50

Type	Values Removed	Values Added
CPE		cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:::::::: cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:::::::: cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:::::::* cpe:2.3:h:siemens:sipass_integrated_ac5102_\(acc-g2\):-:::::::*
First Time		Siemens sipass Integrated Ac5102 \(acc-g2\) Siemens sipass Integrated Acc-ap Siemens sipass Integrated Ac5102 \(acc-g2\) Firmware Siemens sipass Integrated Acc-ap Firmware Siemens
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-515903.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-515903.html - Vendor Advisory

11 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-11 10:15

Updated : 2025-08-22 17:50

NVD link : CVE-2025-27493

Mitre link : CVE-2025-27493

CVE.ORG link : CVE-2025-27493

JSON object : View

Products Affected

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-27493", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-11T10:15:19.577", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-515903.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize user input for specific commands on the telnet command line interface. This could allow an authenticated local administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SiPass integrated AC5102 (ACC-G2) (Todas las versiones < V6.4.9), SiPass integrated ACC-AP (Todas las versiones < V6.4.9). Los dispositivos afectados depuran incorrectamente la entrada del usuario para comandos espec\u00edficos en la interfaz de l\u00ednea de comandos de Telnet. Esto podr\u00eda permitir que un administrador local autenticado aumente los privilegios mediante la inyecci\u00f3n de comandos arbitrarios que se ejecutan con privilegios de superusuario."}], "lastModified": "2025-08-22T17:50:58.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:sipass_integrated_ac5102_\\(acc-g2\\)_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E417E572-D776-4664-9BBB-06579C14A9D9", "versionEndExcluding": "6.4.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:sipass_integrated_ac5102_\\(acc-g2\\):-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0691F0D6-FC6C-41FC-8601-393AECB1E6E9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F867548F-CC8D-4B1F-87C3-9138DCB7F6E3", "versionEndExcluding": "6.4.9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:sipass_integrated_acc-ap:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7E714A08-D557-4F6F-B089-89E3FFB7105A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}