CVE-2025-27494

CRITICAL

SiPass integrated AC5102/ACC-AP <6.4.9 - Privilege Escalation

Title source: llm

Description

A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.

References (1)

Core 1

Core References

Vendor Advisory

https://cert-portal.siemens.com/productcert/html/ssa-515903.html

Scores

CVSS v3 9.1

EPSS 0.0024

EPSS Percentile 47.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (2)

siemens/sipass_integrated_ac5102_\(acc-g2\)_firmware < 6.4.9

siemens/sipass_integrated_acc-ap_firmware < 6.4.9

Published Mar 11, 2025

Tracked Since Feb 18, 2026