Overview
The cybersecurity community has recently identified a critical vulnerability, CVE-2025-26390, that affects users of the OZW672 and OZW772 devices. This vulnerability resides in the web service of the aforementioned devices and is specifically related to SQL injection attacks when checking authentication data. The severity of this vulnerability lies in the potential for an unauthenticated remote attacker to bypass the check and authenticate as an Administrator user, potentially leading to system compromise or data leakage.
Vulnerability Summary
CVE ID: CVE-2025-26390
Severity: Critical (9.8 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
OZW672 | All versions < V6.0 OZW772 | All versions < V6.0 How the Exploit Works
The exploitation takes place when an attacker sends specially crafted SQL commands within authentication data to the web service of the affected devices. The web service fails to properly sanitize the input data, allowing the injection of malicious SQL commands. These commands are then executed in the database context. As a result, an attacker could manipulate SQL queries, potentially leading to unauthorized access as an Administrator user.
Conceptual Example Code
Here is a conceptual example of how a malicious request exploiting this vulnerability could look. In this example, an HTTP request is sent to the vulnerable endpoint with a malicious payload designed to exploit the SQL injection vulnerability.
POST /login HTTP/1.1
Host: vulnerable.device.com
Content-Type: application/x-www-form-urlencoded
username=admin';--&password=In this example, the `username` parameter contains a SQL injection payload. The payload `admin’;–` aims to end the current SQL statement prematurely, comment out the rest of the original query, and authenticate as the admin user without requiring a password.
The best way to mitigate this vulnerability is by applying the vendor patch. If this is not immediately possible, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation. It is, however, strongly recommended to apply the patch as soon as possible due to the high severity of this vulnerability.