CVE-2025-32860

Summary

CVE-2025-32860: A critical SQL injection vulnerability has been discovered in TeleControl Server Basic (versions before V3.1.2.2). This flaw affects the 'UnlockWebServerGatewaySettings' method, which is internally used, making it susceptible to attacks. An authenticated remote attacker can exploit this flaw to bypass authorization controls, gain unauthorized access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. Successful exploitation requires the attacker to have access to port 8000 on a vulnerable system. This vulnerability poses a significant threat, and it is strongly recommended to upgrade to a patched version immediately.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.