SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32860

Summary

A SQL injection vulnerability exists in the TeleControl Server Basic application, specifically affecting all versions prior to V3.1.2.2. The flaw resides in the 'UnlockWebServerGatewaySettings' method, allowing authenticated remote attackers to bypass authorization controls. This could lead to unauthorized access, enabling threat actors to read from and write to the application's database, as well as execute code with 'NT AUTHORITY\NetworkService' permissions. Exploitation of this vulnerability would require the attacker to connect to port 8000 on a system running a vulnerable version of the application.

References