CVE-2025-32475

Summary

CVE-2025-32475 is a newly identified vulnerability affecting TeleControl Server Basic, with versions below V3.1.2.2 being vulnerable. An attacker with access to port 8000 on a susceptible system can exploit the SQL injection vulnerability found in the 'UpdateProject' method. This allows the attacker to bypass authorization controls, read and write to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. The exploitation of this vulnerability could potentially result in serious data breaches or system compromise. This issue was reported as ZDI-CAN-25912.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.