Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

SiPass Integrated Systems: Unauthenticated Admin Privilege Escalation

CVE-2025-27494 · published 1 year ago
Summary

SiPass integrated AC5102 and ACC-AP systems with outdated software are at risk of being taken over by an authorized user with malicious intent. This is a serious concern for organizations that rely on these systems for access control. To stay secure, update to version 6.4.9 or later.

What to do
  • Update siemens sipass_integrated_ac5102_\(acc-g2\)_firmware to version 6.4.9 or later.
  • Update siemens sipass_integrated_acc-ap_firmware to version 6.4.9 or later.
Affected software
VendorProductAffected versions
siemens sipass_integrated_ac5102_\(acc-g2\)_firmware < 6.4.9
cpe:2.3:o:siemens:sipass_integrated_ac5102_\(acc-g2\)_firmware:*:*:*:*:*:*:*:*
siemens sipass_integrated_acc-ap_firmware < 6.4.9
cpe:2.3:o:siemens:sipass_integrated_acc-ap_firmware:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for th...
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected devices improperly sanitize input for the pubkey endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published11 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-27494 · NVD
Track software like this
Free during beta