CVE-2025-32869

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89

Summary

CVE-2025-32869 is a vulnerability affecting TeleControl Server Basic (versions prior to V3.1.2.2). This issue enables authenticated remote attackers to perform SQL injection attacks via the 'ImportCertificate' method. Consequences include bypassing authorization, reading/writing to the application's database, and executing code with "NT AUTHORITY\\NetworkService" permissions. Successful attacks require access to the system's port 8000, where the vulnerable application is executed.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Siemens Telecontrol Server Basic

Affected Vendors

  • Siemens

Advisories, Assessments, and Mitigations