Memory Allocation Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-29931

Summary

A vulnerability exists in TeleControl Server Basic that affects all versions prior to 3.1.2.2. The flaw arises from improper validation of a length field in serialized messages, which is used to determine the memory allocation for deserialization. This oversight could enable an unauthenticated remote attacker to exploit the system, leading to excessive memory allocation and resulting in a partial denial of service. It is important to note that successful exploitation is contingent upon the specific configuration of redundant setups and a disruption in the connection between these servers.

References