CVE-2025-30002

Summary

CVE-2025-30002: A critical SQL injection vulnerability has been discovered in TeleControl Server Basic (versions prior to V3.1.2.2). This issue exposes the 'UpdateConnectionVariables' method to unauthorized SQL manipulation, which can bypass authorization controls. An authenticated attacker, who can access port 8000 on an affected system, may gain read-write access to the database and execute code with "NT AUTHORITY\\NetworkService" permissions. This vulnerability poses a significant risk, allowing unauthorized data access and execution of malicious code.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.