CVE-2025-31349
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-31349 is a newly identified vulnerability affecting TeleControl Server Basic versions below V3.1.2.2. This issue permits authenticated remote attackers to perform SQL injection attacks using the 'UpdateSmtpSettings' method. By exploiting this vulnerability, an attacker can bypass authorization controls, read/write to the application's database, and execute code with NT AUTHORITY\NetworkService privileges. Successful exploitation requires access to port 8000 on a vulnerable system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens