CVE-2018-25333
📛 CVE Title
(no title)
Description
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 8.2 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N- Effective score
- 8.2 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2018-25333
- Linked Threat
- CVE-2018-25333 — CVE-2018-25333
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-17 13:16:44 UTC
- NVD last modified
- 2026-05-18 20:16:05 UTC
- NVD CVSS v3.1
- 8.2 / 10 HIGH source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 4.2 / 10
- EPSS score
- 0.0025 (probability of exploitation in next 30 days)
- EPSS percentile
- 48.25% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-89
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:11 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2018-21857 - Assigner
- VulnCheck
- Published
- May 17, 2026, 12:11:37 PM
- Updated
- May 26, 2026, 11:51:37 AM
- EUVD base score (CVSS 4.0)
-
8.8 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.2500
- Vendors
- nordex-online
- Products
-
N149 Wind Turbine Web Server (4.0 ≤4.5)N149 Wind Turbine Web Server (4.0 - 4.5)
- Aliases
-
GHSA-c5h2-3p8v-g4pm
ENISA description: Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (6)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- http://www.nordex-online.com tenable:www.nordex-online.com
- https://nvd.nist.gov/vuln/detail/CVE-2018-25333 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2018-25333 tenable:www.cve.org
- https://www.exploit-db.com/exploits/44684 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/nordex-n149-wind-turbine-web-server-sql-injection tenable:www.vulncheck.com
NVD-tagged references (3)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- http://www.nordex-online.com disclosure@vulncheck.com
- https://www.exploit-db.com/exploits/44684 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/nordex-n149-wind-turbine-web-server-sql-injection disclosure@vulncheck.com
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:attack.mitre.org
This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...
2026-05-26 02:57 UTC -
web:cheatsheetseries.owasp.org
Virtual Patching Cheat Sheet Introduction The goal with this cheat Sheet is to present a concise virtual patching framework that organizations can follow to maximize the timely implementation of mitigation protections. Definition: Virtual Patching A security policy enforcement layer which prevents and reports the exploitation attempt of a known vulnerability. The virtual patch works when the ...
2026-05-26 02:57 UTC -
web:community.ui.com
Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...
2026-05-26 02:57 UTC -
web:nvd.nist.gov
Information Technology Laboratory National Vulnerability Database Vulnerabilities
2026-05-26 02:57 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-26 02:57 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-26 02:57 UTC -
web:thecyberexpress.com
CISA issues Directive 25-03 to address CVE -2025-20333 and related Cisco ASA threats, urging agencies to patch systems and mitigate active exploitation.
2026-05-26 02:57 UTC -
web:www.ibm.com
Remediation /Fixes IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH68976. Attention: After installing the interim fix or fixpack, please follow the additional instructions provided in the interim fix link referenced below to complete the remediation . For IBM WebSphere Application Server ...
2026-05-26 02:57 UTC -
web:www.watchguard.com
WatchGuard Patch Management is an add-on module that helps organizations identify, prioritize, and deploy security patches across operating systems and third-party applications. It supports Windows, macOS, and Linux workstations and servers, as well as hundreds of third-party applications, helping reduce the attack surface, improve patch consistency, and strengthen overall endpoint security.
2026-05-26 02:57 UTC -
web:www.wowhead.com
Here you'll find a list of hotfixes that address various issues related to World of Warcraft: Midnight, Mists of Pandaria Classic, Season of Discovery, Burning Crusade Classic, WoW Classic Era, and Hardcore. Some of the hotfixes below take effect the moment they were implemented, while others may require scheduled realm restarts to go into effect. Please keep in mind that some issues cannot be ...
2026-05-26 02:57 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.