SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32835

What is CVE-2025-32835?

A vulnerability exists in TeleControl Server Basic affecting all versions earlier than V3.1.2.2, allowing SQL injection through the 'UpdateConnectionVariableArchivingBuffering' method. This flaw could enable authenticated remote attackers to bypass authorization and gain unauthorized access to the database. Attackers with access to port 8000 of a vulnerable server may exploit this vulnerability to read, write, and execute commands within the database with elevated permissions associated with 'NT AUTHORITY\NetworkService'.

References