SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32863

Summary

A vulnerability exists in TeleControl Server Basic that allows for SQL injection via the 'UnlockTraceLevelSettings' method. This flaw can be exploited by an authenticated remote attacker to bypass authorization controls, enabling unauthorized access to the database. The attacker could potentially read and write to the database and execute code with the permissions of 'NT AUTHORITY\NetworkService'. Successful exploitation of this vulnerability requires access to port 8000 on the affected system running a vulnerable version of the application.

References