SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32826

Summary

A SQL injection vulnerability exists in TeleControl Server Basic, specifically affecting all versions prior to 3.1.2.2. This flaw enables authenticated remote attackers to exploit the 'GetActiveProjects' method, which can lead to the circumvention of authorization controls. If successful, attackers may gain unauthorized access to read from and write to the application's database, as well as execute code under the 'NT AUTHORITY\NetworkService' account. The exploitation requires access to port 8000 on systems running vulnerable versions of the software.

References