SQL Injection Vulnerability in TeleControl Server Basic by Siemens
CVE-2025-27495

9.3CRITICAL

Key Information:

Vendor

Siemens
Status
Telecontrol Server Basic
Vendor
CVE Published:
16 April 2025

What is CVE-2025-27495?

A vulnerability in TeleControl Server Basic allows for SQL injection through the application's 'CreateTrace' method. This flaw enables an unauthenticated attacker to bypass authorization controls and manipulate the database. Attackers exploiting this vulnerability could read or write database entries and execute arbitrary commands with 'NT AUTHORITY\NetworkService' permissions. Access to port 8000 on the vulnerable system is required for an attack to succeed.

Affected Version(s)

TeleControl Server Basic 0

References

https://cert-portal.siemens.com/productcert/html/ssa-4434...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

.