Nordex N149 Wind Turbine Web Server versions 4.0 through 4.5 expose an unauthenticated SQL injection flaw in the login.php module. Malicious actors can submit crafted POST requests to the login field, allowing execution of arbitrary SQL statements against the server’s database. This can lead to extraction of sensitive information and bypass of authentication controls, compromising data confidentiality and integrity.

Affected units are the Nordex N149 Wind Turbine Web Server running firmware versions 4.0 to 4.5, which include the vulnerable login.php code as shipped by Nordex Online.

The CVSS base score of 8.8 classifies the vulnerability as high severity. With no EPSS data available and the issue not listed in the CISA KEV catalog, the likelihood of widespread exploitation is uncertain. The most plausible attack vector is a web‑based, unauthenticated POST request to the device’s public login interface, which can be conducted from any network that can reach the turbine’s web UI. Exploitation would enable the adversary to read or modify database contents and potentially gain privileged access, but the description does not support claims of full system takeover.