CVE-2025-31353

Summary

CVE-2025-31353 is a newly discovered vulnerability that affects TeleControl Server Basic versions below V3.1.2.2. This issue enables an authenticated remote attacker to execute SQL injection attacks through the 'UpdateOpcSettings' method. By exploiting this vulnerability, the attacker can bypass authorization controls, read and write to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. For an attack to be successful, the attacker must have access to port 8000 on a vulnerable system. This poses a significant risk as it can lead to unauthorized access and data manipulation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.