CVE-2025-32828

Summary

CVE-2025-32828 is a newly identified vulnerability affecting TeleControl Server Basic versions below V3.1.2.2. The issue resides in the 'UpdateProjectCrossCommunications' method, which is vulnerable to SQL injection attacks. An authenticated attacker can exploit this vulnerability to bypass authorization controls, gain unauthorized access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" privileges. Successful exploitation requires the attacker to have access to port 8000 on a system running the vulnerable application. This vulnerability poses a significant risk as it allows attackers to manipulate data and potentially cause damage to the targeted system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.