CVE-2025-32846

Summary

CVE-2025-32846 is a newly identified vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. This issue allows authenticated remote attackers to exploit SQL injection vulnerabilities in the 'LockGeneralSettings' method. By doing so, they can bypass authorization controls and gain unauthorized access to the application's database. This could lead to data manipulation and even code execution with "NT AUTHORITY\\NetworkService" permissions. Successful attacks require the attacker to have access to port 8011 on a vulnerable system. This vulnerability poses a significant threat and implies the need for immediate patching and secure configuration of the affected applications.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.