CVE-2025-32866

Summary

CVE-2025-32866 is a newly discovered vulnerability affecting TeleControl Server Basic versions prior to V3.1.2.2. This issue enables authenticated attackers to execute SQL injection attacks on the 'GetLogs' method, bypassing authorization controls. The attacker can subsequently read from and write to the application's database and execute code with the privileged "NT AUTHORITY\\NetworkService" permissions. To exploit this vulnerability, the attacker must gain access to port 8000 on a targeted system running the vulnerable version of the application.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.