CVE-2025-32824

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89

Summary

CVE-2025-32824 is a newly identified vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. An attacker with access to port 8000 on a vulnerable system can exploit this SQL injection vulnerability in the 'UnlockProject' method. By doing so, they can bypass authorization controls, gain read and write access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions, potentially leading to serious data breaches or unauthorized system access.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Siemens Telecontrol Server Basic

Affected Vendors

  • Siemens

Advisories, Assessments, and Mitigations