CVE-2025-32854

Summary

CVE-2025-32854 is a newly identified vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. This issue permits authenticated remote attackers to bypass authorization controls by exploiting SQL injection vulnerabilities in the 'LockOpcSettings' method. Successful exploitation of this vulnerability allows attackers to read from and write to the application's database and execute code with "NT AUTHORITY\\NetworkService" permissions. To take advantage of this vulnerability, an attacker needs access to port 8000 on a vulnerable system. This security weakness poses a significant risk to affected organizations and necessitates immediate patching.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.