CVE-2025-27540

Summary

CVE-2025-27540 is a newly discovered vulnerability affecting TeleControl Server Basic (all versions before V3.1.2.2). This issue allows an unauthenticated remote attacker to perform SQL injection attacks through the 'Authenticate' method. By exploiting this vulnerability, the attacker can bypass authorization controls, gain access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. Successful attacks require an attacker to access port 8000 on a vulnerable system. This weakness poses a serious risk to organizations using TeleControl Server Basic and should be addressed promptly by updating to the latest version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.