SQL Injection Vulnerability in TeleControl Server Basic Affected by Siemens

CVE-2025-32475

What is CVE-2025-32475?

A SQL injection vulnerability exists in Siemens' TeleControl Server Basic which affects all versions prior to 3.1.2.2. This vulnerability arises from improper handling of input in the 'UpdateProject' method, enabling authenticated remote attackers to bypass authorization mechanisms. This exploitation can lead to unauthorized reading and writing of the application's database as well as the execution of arbitrary code with the permissions of 'NT AUTHORITY\NetworkService'. For successful exploitation, the attacker must gain access to port 8000 on the host system running the vulnerable application.

References