CVE-2025-32825

Summary

CVE-2025-32825 is a newly identified vulnerability that affects TeleControl Server Basic versions prior to V3.1.2.2. The vulnerability lies in the 'GetProjects' method, which is internally used and susceptible to SQL injection attacks. An authenticated remote attacker can exploit this vulnerability to bypass authorization controls, gain unauthorized access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. To successfully exploit the vulnerability, the attacker must first access port 8000 on a targeted system where the affected application is in use. This flaw poses a significant risk, as it can result in data breaches, unauthorized system access, and potential code execution.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.