CVE-2025-32850

Summary

CVE-2025-32850 is a newly discovered vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. This issue enables authenticated attackers to perform SQL injection attacks through the 'LockTcmSettings' method, which is used internally. By exploiting this vulnerability, attackers can bypass authorization controls, gain unauthorized read and write access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. To successfully carry out an attack, an attacker must have access to port 8000 on a system where a susceptible version of the application is running.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.