SQL Injection in Nordex-Online N149 Wind Turbine Web Server
CVE-2018-25333
Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Nordex-Online N149 Wind Turbine Web Server — versions 4.0, 4.0 - 4.5
Weakness classification (CWE)
References
- www.nordex-online.com (product)
- www.exploit-db.com/exploits/44684 (exploit)
- www.vulncheck.com/advisories/nordex-n149-wind-turbine-web-server-sql-injection (third-party-advisory)
Frequently asked questions
- What is CVE-2018-25333?
- CVE-2018-25333 is a high-severity vulnerability in Nordex-Online N149 Wind Turbine Web Server, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-05-17.
- How severe is CVE-2018-25333?
- High severity. CVSS v3 base score is 8.2 out of 10.