SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32839

Summary

A serious SQL injection vulnerability exists in TeleControl Server Basic, specifically in versions prior to 3.1.2.2. This flaw is found within the 'GetGateways' method and can be exploited by an authenticated remote attacker. By leveraging this vulnerability, attackers could bypass authorization controls, allowing them to read from and write to the application’s database. Additionally, the attacker could execute commands with 'NT AUTHORITY\NetworkService' privileges. Exploiting this vulnerability necessitates access to port 8000 on the affected system, presenting significant risks to security and data integrity.

References