SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32862

Summary

A significant SQL injection vulnerability has been discovered in TeleControl Server Basic, affecting all versions prior to 3.1.2.2. This flaw arises from the internally used 'LockTraceLevelSettings' method, enabling authenticated remote attackers to compromise authorization controls. By exploiting this vulnerability, attackers can read from and write to the database, and execute commands with the permissions of 'NT AUTHORITY\NetworkService'. Access to the affected system's port 8000 is necessary for a successful attack, presenting serious risks to the integrity and confidentiality of sensitive data.

References