CVE-2025-32834
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-32834 is a newly identified vulnerability affecting TeleControl Server Basic (versions prior to V3.1.2.2). This issue allows authenticated remote attackers to bypass authorization controls by exploiting an SQL injection vulnerability found in the 'UpdateConnectionVariablesWithImport' method. The attacker can then read sensitive data, modify it, and even execute code with "NT AUTHORITY\\NetworkService" permissions. To successfully launch an attack, the attacker must have access to port 8000 on a vulnerable system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens