Overview
The cybersecurity community has recently identified a critical vulnerability, CVE-2025-26390, that affects users of the OZW672 and OZW772 devices. This vulnerability resides in the web service of the aforementioned devices and is specifically related to SQL injection attacks when checking authentication data. The severity of this vulnerability lies in the potential for an unauthenticated remote attacker to bypass the check and authenticate as an Administrator user, potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-26390
Severity: Critical (9.8 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
OZW672 | All versions < V6.0 OZW772 | All versions < V6.0 How the Exploit Works
The exploitation takes place when an attacker sends specially crafted SQL commands within authentication data to the web service of the affected devices. The web service fails to properly sanitize the input data, allowing the injection of malicious SQL commands. These commands are then executed in the database context. As a result, an attacker could manipulate SQL queries, potentially leading to unauthorized access as an Administrator user.
Conceptual Example Code
Here is a conceptual example of how a malicious request exploiting this vulnerability could look. In this example, an HTTP request is sent to the vulnerable endpoint with a malicious payload designed to exploit the SQL injection vulnerability.
POST /login HTTP/1.1
Host: vulnerable.device.com
Content-Type: application/x-www-form-urlencoded
username=admin';--&password=In this example, the `username` parameter contains a SQL injection payload. The payload `admin’;–` aims to end the current SQL statement prematurely, comment out the rest of the original query, and authenticate as the admin user without requiring a password.
The best way to mitigate this vulnerability is by applying the vendor patch. If this is not immediately possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation. It is, however, strongly recommended to apply the patch as soon as possible due to the high severity of this vulnerability.