Siemens Telecontrol Server Basic
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Siemens Telecontrol Server Basic.
By the Year
In 2025 there have been 70 vulnerabilities in Siemens Telecontrol Server Basic with an average score of 8.8 out of ten. Last year, in 2024 Telecontrol Server Basic had 1 security vulnerability published. That is, 69 more vulnerabilities have already been reported in 2025 as compared to last year. Last year, the average CVE base score was greater by 1.23
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 70 | 8.77 |
| 2024 | 1 | 10.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 6.50 |
| 2021 | 1 | 7.50 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 7.50 |
| 2018 | 3 | 7.20 |
It may take a day or so for new Telecontrol Server Basic vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Siemens Telecontrol Server Basic Security Vulnerabilities
Info Disclosure in TeleControl Server Basic V3.1.1: Hash Leak (CVE-2025-40765)
CVE-2025-40765
9.8 - Critical
- October 14, 2025
A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.
Missing Authentication for Critical Function
DLL Hijacking in Windows Setup Component Enables RCE
CVE-2025-30033
7.8 - High
- August 12, 2025
The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
DLL preloading
DoS via Unvalidated Length in TeleControl Server Basic <3.1.2.2
CVE-2025-29931
3.7 - Low
- April 17, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a serialized message which it uses to determine the amount of memory to be allocated for deserialization. This could allow an unauthenticated remote attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of service condition. Successful exploitation is only possible in redundant Telecontrol Server Basic setups and only if the connection between the redundant servers has been disrupted.
length manipulation
SQLi in TeleControl Server Basic <v3.1.2.2 via UnlockProject
CVE-2025-32824
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <=V3.1.2.2 SQL Injection via LockGateway (Auth Bypass)
CVE-2025-32840
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockGateway' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2, GetProjects, Auth Bypass
CVE-2025-32825
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetProjects' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2, Auth Attacker
CVE-2025-32826
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetActiveProjects' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <V3.1.2.2: SQLi in ActivateProject enabling auth bypass
CVE-2025-32827
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ActivateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via UpdateProjectCrossCommunications
CVE-2025-32828
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectCrossCommunications' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <V3.1.2.2 SQLi via LockProjectCrossCommunications
CVE-2025-32829
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProjectCrossCommunications' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic SQLi in UnlockProject (<V3.1.2.2)
CVE-2025-32830
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi via UpdateProjectUserRights in TeleControl Server Basic <3.1.2.2
CVE-2025-32831
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <3.1.2.2 SQLi via LockProjectUserRights
CVE-2025-32832
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic (<V3.1.2.2) via UnlockProjectUserRights
CVE-2025-32833
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockProjectUserRights' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via UpdateConnectionVariables
CVE-2025-32834
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariablesWithImport' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic SQLi UpdConnVarArchBuff <v3.1.2.2
CVE-2025-32835
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariableArchivingBuffering' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic GetConnectionVariables (v<3.1.2.2)
CVE-2025-32836
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Base <3.1.2.2 via GetActiveConnectionVariables
CVE-2025-32837
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetActiveConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via ImportConnectionVariables
CVE-2025-32838
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via GetGateways – Auth Bypass
CVE-2025-32839
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi: TeleControl Server Basic <V3.1.2.2 GetUsers – Exec NT AUTHORITY\NetworkService
CVE-2025-32842
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi via UpdateDatabaseSettings in TeleControl Server Basic <V3.1.2.2
CVE-2025-30032
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateDatabaseSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25921)
SQL Injection
TeleControl Server Basic SQLi via CreateTrace (V<3.1.2.2) Unauth Remote
CVE-2025-27495
9.8 - Critical
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateTrace' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25911)
SQL Injection
SQLi via VerifyUser in TeleControl Server Basic <3.1.2.2
CVE-2025-27539
9.8 - Critical
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'VerifyUser' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25914)
SQL Injection
SQL injection in TeleControl Server Basic <3.1.2.2 via Authenticate
CVE-2025-27540
9.8 - Critical
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25913)
SQL Injection
TeleControl Server Basic <3.1.2.2 SQLi via RestoreFromBackup
CVE-2025-29905
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'RestoreFromBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25923)
SQL Injection
TeleControl Server Basic <3.1.2.2: Auth SQLi via UpdateConnectionVariables
CVE-2025-30002
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateConnectionVariables' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25909)
SQL Injection
TeleControl Server Basic <3.1.2.2: SQLi in UpdateProjectConn (NetworkService)
CVE-2025-30003
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProjectConnections' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25910)
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via ImportDatabase
CVE-2025-30030
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25924)
SQL Injection
SQLi via UpdateUsers in TeleControl Server Basic <3.1.2.2
CVE-2025-30031
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateUsers' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25922)
SQL Injection
TeleControl Server Basic < V3.1.2.2 SQL Injection via LockProject (Auth Bypass)
CVE-2025-32823
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'LockProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via UpdateTcmSettings (Auth Bypass)
CVE-2025-31343
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateTcmSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25920)
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via UpdateSmtpSettings(8000)
CVE-2025-31349
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateSmtpSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25919)
SQL Injection
SQLi in TeleControl SB <V3.1.2.2 via UpdateBufferingSettings (Auth R)
CVE-2025-31350
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateBufferingSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25918)
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via CreateProject (NetworkService exec)
CVE-2025-31351
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25917)
SQL Injection
SQLi in TeleControl Server Basic <V3.1.2.2 via UpdateGateways
CVE-2025-31352
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateGateways' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25915)
SQL Injection
TeleControl Server Basic SQLi in UpdateOpcSettings (All <3.1.2.2)
CVE-2025-31353
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateOpcSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25916)
SQL Injection
TeleControl Server Basic SQLi via UpdateProject before v3.1.2.2
CVE-2025-32475
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25912)
SQL Injection
TeleControl Server Basic <V3.1.2.2: Auth Bypass & SQLi via DeleteProject
CVE-2025-32822
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'DeleteProject' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi via UnlockGateway in TeleControl Server Basic <3.1.2.2
CVE-2025-32841
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockGateway' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <V3.1.2.2 via GetOverview, Auth Bypass
CVE-2025-32872
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetOverview' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQL Injection in TeleControl Server Basic MigrateDatabase (<3.1.2.2)
CVE-2025-32871
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'MigrateDatabase' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi in TeleControl Server Basic <3.1.2.2 via GetTraces Auth Bypass
CVE-2025-32870
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetTraces' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQL Injection in TeleCtrl Server Basic <3.1.2.2 via ImportCert -> Auth Rmt CE
CVE-2025-32869
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ImportCertificate' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi via ExportCrt in TeleControl Server Basic <3.1.2.2 (NT AUTHORITY Escalation)
CVE-2025-32868
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'ExportCertificate' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
SQLi via CreateBackup in TeleControl Server Basic <3.1.2.2
CVE-2025-32867
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateBackup' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <v3.1.2.2: GetLogs SQLi Auth Bypass
CVE-2025-32866
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetLogs' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic <3.1.2.2 SQLi via CreateLog lets attacker exec code
CVE-2025-32865
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'CreateLog' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic SQLi via GetSettings (v<3.1.2.2)
CVE-2025-32864
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'GetSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
TeleControl Server Basic SQLi via UnlockTraceLevelSettings (<V3.1.2.2)
CVE-2025-32863
8.8 - High
- April 16, 2025
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UnlockTraceLevelSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on.
SQL Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Siemens Telecontrol Server Basic or by Siemens? Click the Watch button to subscribe.
