Information disclosure in Siemens OZW672 and Siemens OZW772 - CVE-2019-13941
Published: February 12, 2020
Vulnerability identifier: #VU25262
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13941
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the OZW web server uses predictable path names for project files that legitimately authenticated users have created by using the application’s export function. A remote attacker can access a specific uniform resource locator on the web server and download a project file without prior authentication.
Affected software
Siemens OZW672
Siemens OZW772
Siemens OZW772
How to mitigate CVE-2019-13941
Install updates from vendor's website.
Siemens OZW672 - update to 10.0
Siemens OZW772 - update to 10.0
Siemens OZW772 - update to 10.0