SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32836

What is CVE-2025-32836?

A vulnerability has been identified in TeleControl Server Basic, affecting all versions prior to V3.1.2.2. This vulnerability arises from an SQL injection flaw in the 'GetConnectionVariables' method, which can be exploited by an authenticated remote attacker. If exploited, it allows the attacker to bypass authorization controls, enabling unauthorized access to both read from and write to the application's database. Furthermore, the attacker can execute code with elevated privileges, specifically as 'NT AUTHORITY\NetworkService'. To successfully exploit this vulnerability, the attacker must have access to port 8000 on the vulnerable system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References