CVE-2025-31351

Summary

CVE-2025-31351 is a newly identified vulnerability that affects TeleControl Server Basic versions below V3.1.2.2. The issue lies in the 'CreateProject' method, which is susceptible to SQL injection. An authenticated attacker with network access to port 8000 on a vulnerable system can exploit this vulnerability to bypass authorization controls, gain unauthorized access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. This poses a significant risk, as sensitive data could be read, modified, or deleted.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.