SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-27539

Summary

A significant SQL injection vulnerability has been identified in TeleControl Server Basic prior to version 3.1.2.2. This flaw, located in the 'VerifyUser' method, enables an unauthenticated remote attacker to manipulate database operations. By exploiting this vulnerability, attackers could bypass authorization controls, gain unauthorized access to sensitive data, and execute malicious code with elevated permissions, specifically using the 'NT AUTHORITY\NetworkService' account. Access to port 8000 is necessary for the attack to succeed, emphasizing the importance of securing network configurations to mitigate this risk.

References