SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32855

Summary

A vulnerability exists in the TeleControl Server Basic that allows for SQL injection through the 'UnlockOpcSettings' method. This flaw could permit an authenticated remote attacker to bypass authorization, enabling unauthorized access to the application's database for reading and writing data. Moreover, it may allow the execution of code with 'NT AUTHORITY\NetworkService' permissions. To exploit this vulnerability, an attacker needs to access port 8000 on a system running a vulnerable version of the application.

References