CVE-2025-32843
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-32843 is a newly identified vulnerability that affects TeleControl Server Basic, with versions below V3.1.2.2 being susceptible. This issue involves SQL injection vulnerability in the 'LockUser' method used internally. An authenticated remote attacker can exploit this bypassing authorization controls, gaining access to read from and write to the application's database, and executing code with "NT AUTHORITY\\NetworkService" permissions. To successfully attack, the attacker must be able to connect to port 8000 on a vulnerable system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens