SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32841

Summary

A security flaw has been found in TeleControl Server Basic, affecting all versions prior to 3.1.2.2. The vulnerability stems from an SQL injection issue within the 'UnlockGateway' method, enabling authenticated remote attackers to exploit authorization weaknesses. This could potentially allow unauthorized access to the application’s database, permitting attackers to read from and manipulate data, as well as execute commands with elevated network permissions. To successfully exploit this vulnerability, attackers need to gain access to port 8000 on a system running the vulnerable application.

References