CVE-2025-32827

Summary

CVE-2025-32827 is a newly identified vulnerability that affects TeleControl Server Basic versions below V3.1.2.2. This issue enables authenticated remote attackers to bypass authorization controls through SQL injection, exploiting the 'ActivateProject' method. The vulnerability allows unauthorized access to the application's database and the execution of code with "NT AUTHORITY\\NetworkService" permissions. Successful attacks require access to port 8011 on a system hosting a vulnerable version of the application. Malicious actors could leverage this vulnerability to gain unauthorized access and manipulate the database, posing a serious threat to organizational security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.