SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32842

Summary

A vulnerability exists in TeleControl Server Basic prior to version 3.1.2.2 that is susceptible to SQL injection through the 'GetUsers' method. This flaw allows an authenticated remote attacker to circumvent authorization mechanisms, potentially gaining unauthorized access to the application's database. As a result, the attacker may read from or modify sensitive data and execute commands with elevated permissions via the 'NT AUTHORITY\NetworkService' context. Exploiting this vulnerability necessitates the attacker having access to port 8000, where the vulnerable implementation runs.

References