CVE-2025-32826

Summary

CVE-2025-32826 is a newly discovered vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. An authenticated attacker can exploit this SQL injection flaw in the 'GetActiveProjects' method, bypassing authorization controls and gaining unauthorized access to the application's database. With this access, the attacker can read sensitive data, write to the database, and even execute code with "NT AUTHORITY\\NetworkService" permissions. Successful exploitation requires the attacker to have network access to the affected system, specifically port 8000.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.