SQL Injection Vulnerability in TeleControl Server Basic by Siemens
CVE-2025-27495
9.3CRITICAL
Summary
A vulnerability in TeleControl Server Basic allows for SQL injection through the application's 'CreateTrace' method. This flaw enables an unauthenticated attacker to bypass authorization controls and manipulate the database. Attackers exploiting this vulnerability could read or write database entries and execute arbitrary commands with 'NT AUTHORITY\NetworkService' permissions. Access to port 8000 on the vulnerable system is required for an attack to succeed.
Affected Version(s)
TeleControl Server Basic 0
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published