SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-32866

Summary

A vulnerability has been detected in the TeleControl Server Basic application, which allows for SQL injection through the 'GetLogs' method. This flaw enables an authenticated remote attacker to bypass authorization controls, facilitating unauthorized access to the database. Attackers can potentially read, write, and execute code with elevated permissions within the application. To exploit this vulnerability, the attacker must have access to port 8000 on a system running an affected version of TeleControl Server Basic. It is crucial for users of the software to upgrade to version 3.1.2.2 or later to mitigate this risk.

References