SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32843

What is CVE-2025-32843?

A vulnerability has been discovered in Siemens TeleControl Server Basic that allows for SQL injection through the internally used 'LockUser' method. This flaw enables an authenticated remote attacker, capable of accessing the system's port 8000, to bypass authorization controls. Consequently, the attacker can read from and write to the application's database, and execute code with the permissions of 'NT AUTHORITY\NetworkService'. Addressing this vulnerability is critical to ensure the integrity and security of the application.

References