CVE-2025-32864
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-32864 is a newly discovered vulnerability impacting TeleControl Server Basic versions prior to V3.1.2.2. This issue allows authenticated, remote attackers to bypass authorization controls by executing SQL injection attacks on the 'GetSettings' method. By exploiting this vulnerability, attackers can read sensitive data, write to the database, and execute code with the "NT AUTHORITY\\NetworkService" permissions. To successfully attack a system, the adversary must have access to port 8000 where the affected application is running.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens