SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32857

Summary

A vulnerability exists in TeleControl Server Basic that allows attackers to exploit SQL injection through the 'UnlockBufferingSettings' method. This exploit is particularly concerning for authenticated remote users who can access port 8000 on a vulnerable system. The flaw could enable these attackers to bypass authority checks, potentially gaining unauthorized access to read from and write to the application's database, and execute code with the same privileges assigned to the 'NT AUTHORITY\NetworkService' account. Immediate attention and remediation are essential for organizations utilizing affected versions of this software.

References