CVE-2025-32872
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Apr 16, 2025
Updated: Apr 17, 2025
CWE ID 89
Summary
CVE-2025-32872 is a vulnerability affecting TeleControl Server Basic (all versions < V3.1.2.2). This issue enables an authenticated remote attacker to perform SQL injection through the 'GetOverview' method, which in turn allows bypassing authorization controls. The attacker can read from and write to the application's database and execute code with "NT AUTHORITY\\NetworkService" permissions. Prerequisite for a successful attack is an attacker's ability to access port 8000 on a system where the vulnerable application is executed.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Siemens Telecontrol Server Basic
Affected Vendors
- Siemens