SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32849

Summary

A SQL injection vulnerability exists in TeleControl Server Basic versions prior to V3.1.2.2, specifically through the 'UnlockSmtpSettings' method. This flaw can be exploited by an authenticated remote attacker who can access the service over port 8000. Successful exploitation allows the attacker to bypass authorization controls, gaining the ability to read from and write to the application's database, as well as execute arbitrary code with elevated permissions associated with 'NT AUTHORITY\NetworkService'.

References