SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32831

Summary

A vulnerability has been detected in TeleControl Server Basic, affecting all versions prior to 3.1.2.2. This vulnerability allows an authenticated remote attacker to perform SQL injection via the 'UpdateProjectUserRights' method. If exploited, the attacker can bypass authorization controls to gain unauthorized access to the application's database, allowing them to read and write data as well as execute code with elevated privileges under 'NT AUTHORITY\NetworkService'. An attack is feasible if the attacker has access to port 8000 on a system running the affected application.

References