SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32824

What is CVE-2025-32824?

A significant vulnerability has been detected in the TeleControl Server Basic application used by Siemens. This flaw allows for SQL injection through the 'UnlockProject' method. An authenticated remote attacker could exploit this vulnerability to bypass authorization controls, potentially gaining unauthorized access to the database. This could permit the attacker to read from and write to the database, as well as execute code with elevated privileges under 'NT AUTHORITY\NetworkService'. To execute a successful attack, access to port 8000 on the affected system is required, posing a serious security threat if left unaddressed.

References