CVE-2025-32865

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89

Summary

CVE-2025-32865 is a newly discovered vulnerability affecting TeleControl Server Basic versions below V3.1.2.2. The issue lies in the 'CreateLog' method, which is susceptible to SQL injection attacks. An authenticated remote attacker can exploit this vulnerability to bypass authorization controls, gain read-write access to the application's database, and execute code with "NT AUTHORITY\\NetworkService" permissions. To successfully attack, the adversary must have network access to port 8000 on a vulnerable system.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Siemens Telecontrol Server Basic

Affected Vendors

  • Siemens

Advisories, Assessments, and Mitigations