SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32830

Summary

A SQL injection vulnerability has been discovered in the TeleControl Server Basic application, specifically affecting all versions prior to 3.1.2.2. This vulnerability arises from the 'UnlockProject' method, which is utilized internally within the application. An authenticated remote attacker could exploit this flaw by bypassing authorization controls, enabling access to read from and write to the application's database. Additionally, this could allow the execution of code with permissions associated with 'NT AUTHORITY\NetworkService'. For a successful exploitation, the attacker needs to access port 8000 on a system running the vulnerable version of the application.

References