CVE-2025-32840

Summary

CVE-2025-32840 is a newly discovered vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. This issue allows an authenticated attacker to conduct SQL injection attacks on the internally used 'LockGateway' method. By exploiting this vulnerability, the attacker can bypass authorization controls, gain unauthorized access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. This attack requires the attacker to have access to port 8000 on a vulnerable system. Successful exploitation could result in significant data theft or unauthorized system modifications.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.