CVE-2025-32856

Summary

CVE-2025-32856 is a newly discovered vulnerability affecting TeleControl Server Basic versions below V3.1.2.2. The issue lies in the 'LockBufferingSettings' method, which is internally used and susceptible to SQL injection attacks. An authenticated remote attacker can exploit this vulnerability to bypass authorization controls, gain unauthorized access to the application's database, and execute code with the permissions of "NT AUTHORITY\\NetworkService". To exploit this vulnerability, the attacker must be able to connect to port 8000 on a target system where the susceptible version of the application is running. Successful attacks could lead to significant data exposure or system compromise. Users are strongly advised to update to the latest version of TeleControl Server Basic to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.