CVE-2025-32849
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-32849 is a newly discovered vulnerability affecting TeleControl Server Basic (versions below V3.1.2.2). An authenticated attacker can exploit this SQL injection vulnerability in the 'UnlockSmtpSettings' method and gain unauthorized access to the application's database. This bypass of authorization controls allows the attacker to read and write data, and even execute code with "NT AUTHORITY\\NetworkService" permissions. For an attack to be successful, an attacker must have access to port 8000 on a vulnerable system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens