CVE-2025-27495
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-27495 is a newly identified vulnerability impacting TeleControl Server Basic versions prior to V3.1.2.2. The issue lies in the 'CreateTrace' method, which is susceptible to SQL injection attacks. An unauthenticated remote attacker can exploit this vulnerability by accessing port 8000 on a vulnerable system, allowing them to bypass authorization controls and gain access to the application's database. They can read sensitive data, write malicious code, and execute it with "NT AUTHORITY\\NetworkService" permissions.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens