CVE-2025-32857

Summary

CVE-2025-32857 is a newly disclosed vulnerability affecting TeleControl Server Basic (versions prior to V3.1.2.2). This issue enables authenticated remote attackers to perform SQL injection attacks via the 'UnlockBufferingSettings' method. Such an assault could bypass authorization controls, granting access to the application's database and the execution of code with "NT AUTHORITY\\NetworkService" permissions. Successful exploitation of this vulnerability necessitates an attacker having the ability to connect to port 8000 on a targeted system hosting the compromised application.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.