SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32829

Summary

A security vulnerability has been discovered in the TeleControl Server Basic, which affects all versions prior to V3.1.2.2. This vulnerability specifically involves SQL injection within the 'LockProjectCrossCommunications' method. An authenticated remote attacker could leverage this flaw to bypass necessary authorization controls, leading to unauthorized access to the application's database. This may allow for reading sensitive information and executing code with 'NT AUTHORITY\NetworkService' permissions. To exploit this vulnerability, an attacker must have access to port 8000 on a system running the vulnerable version.

References