CVE-2025-32844

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockUser' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-443402.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*

History

19 Aug 2025, 15:13

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-443402.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-443402.html - Vendor Advisory
First Time		Siemens telecontrol Server Basic Siemens
CPE		cpe:2.3:a:siemens:telecontrol_server_basic::::::::
Summary		(es) Se ha identificado una vulnerabilidad en TeleControl Server Basic (todas las versiones anteriores a V3.1.2.2). La aplicación afectada es vulnerable a la inyección de SQL mediante el método interno "UnlockUser". Esto podría permitir que un atacante remoto autenticado eluda los controles de autorización, lea y escriba en la base de datos de la aplicación y ejecute código con permisos "NT AUTHORITY\NetworkService". Para que el ataque tenga éxito, el atacante debe poder acceder al puerto 8000 de un sistema donde se ejecute una versión vulnerable de la aplicación afectada.

16 Apr 2025, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-16 18:16

Updated : 2025-08-19 15:13

NVD link : CVE-2025-32844

Mitre link : CVE-2025-32844

CVE.ORG link : CVE-2025-32844

JSON object : View

Products Affected

siemens

telecontrol_server_basic

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-32844", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-16T18:16:13.337", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-443402.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockUser' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with \"NT AUTHORITY\\NetworkService\" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en TeleControl Server Basic (todas las versiones anteriores a V3.1.2.2). La aplicaci\u00f3n afectada es vulnerable a la inyecci\u00f3n de SQL mediante el m\u00e9todo interno \"UnlockUser\". Esto podr\u00eda permitir que un atacante remoto autenticado eluda los controles de autorizaci\u00f3n, lea y escriba en la base de datos de la aplicaci\u00f3n y ejecute c\u00f3digo con permisos \"NT AUTHORITY\\NetworkService\". Para que el ataque tenga \u00e9xito, el atacante debe poder acceder al puerto 8000 de un sistema donde se ejecute una versi\u00f3n vulnerable de la aplicaci\u00f3n afectada."}], "lastModified": "2025-08-19T15:13:12.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5A439C0E-7853-489C-93A5-40596265F6D0", "versionEndExcluding": "3.1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}