Nordex N149/4.0-4.5 Wind Turbine Web Server Vulnerability: Unauthenticated SQLi
The National Vulnerability Database highlights CVE-2018-25333, a critical SQL injection vulnerability impacting Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0. This flaw allows unauthenticated attackers to execute arbitrary SQL queries. The attack vector is straightforward: malicious code injection via the login parameter in login.php.
Attackers can craft POST requests with SQL injection payloads in the login field. This capability translates directly into extracting sensitive database information and, critically, bypassing authentication mechanisms. Given the nature of industrial control systems (ICS) and operational technology (OT) environments, such a vulnerability presents a significant risk, rated with a CVSS score of 8.2 (HIGH).
For defenders, this is a clear call to action. An unauthenticated SQLi on a web server managing critical infrastructure like wind turbines is a direct path to control or sabotage. The attacker’s calculus here is simple: low effort, high impact. Gaining access to these systems can have severe physical consequences, far beyond typical data exfiltration.
What This Means For You
- If your organization operates or maintains Nordex N149/4.0-4.5 Wind Turbines, you must immediately verify the web server version and apply any available patches for CVE-2018-25333. Prioritize network segmentation for these OT assets and implement robust monitoring for unusual login attempts or database queries. This isn't just about data; it's about operational integrity and physical security.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2018-25333: Nordex Wind Turbine Unauthenticated SQL Injection via login.php
title: CVE-2018-25333: Nordex Wind Turbine Unauthenticated SQL Injection via login.php
id: scw-2026-05-17-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2018-25333 by targeting the login.php endpoint with common SQL injection payloads in the POST request's URI query parameters. This indicates an unauthenticated attacker attempting to bypass login mechanisms on Nordex N149/4.0-4.5 wind turbine web servers.
author: SCW Feed Engine (AI-generated)
date: 2026-05-17
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2018-25333/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
uri|contains:
- '/login.php'
cs-method|exact:
- 'POST'
cs-uri-query|contains:
- "' OR '1'='1"
- "' OR 1=1"
- "' OR 'a'='a"
- "' OR a=a"
condition: uri AND cs-method AND cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2018-25333 | SQLi | Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 |
| CVE-2018-25333 | SQLi | login.php |
| CVE-2018-25333 | SQLi | login parameter |
| CVE-2018-25333 | Auth Bypass | login.php via SQL injection |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 17, 2026 at 16:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...