{"id":40723,"date":"2025-05-20T04:42:48","date_gmt":"2025-05-20T04:42:48","guid":{"rendered":""},"modified":"2025-06-22T11:35:40","modified_gmt":"2025-06-22T17:35:40","slug":"cve-2025-26390-critical-sql-injection-vulnerability-in-ozw672-and-ozw772-devices","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-26390-critical-sql-injection-vulnerability-in-ozw672-and-ozw772-devices\/","title":{"rendered":"CVE-2025-26390: Critical SQL Injection Vulnerability in OZW672 and OZW772 Devices<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The cybersecurity community has recently identified a critical vulnerability, CVE-2025-26390, that affects users of the OZW672 and OZW772 devices. This vulnerability resides in the web service of the aforementioned devices and is specifically related to SQL injection attacks when checking authentication data. The severity of this vulnerability lies in the potential for an unauthenticated remote<\/a> attacker to bypass the check and authenticate as an Administrator user, potentially leading to system compromise or data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-26390
\nSeverity: Critical (9.8 CVSS score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n Share secrets securely\r\n <\/h2>\r\n\r\n

\r\n Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.\r\n <\/p>\r\n\r\n

\r\n Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.\r\n <\/p>\r\n\r\n