CVE-2025-27540

The vulnerability results from insufficient input data sanitization in the internal 'Authenticate' method of the application. An unauthenticated remote attacker with access to TCP port 8000 on a system running a vulnerable version of the software can inject malicious SQL code. This allows bypassing access control mechanisms, reading and writing data in the application database, and executing code with the privileges of the 'NT AUTHORITY\NetworkService' account.

An attacker can gain unauthorized access to the application database (read and write), bypass authentication mechanisms, and execute arbitrary code with the privileges of the system network account 'NT AUTHORITY\NetworkService', which may lead to further system compromise.

Siemens TeleControl Server Basic should be updated to version V3.1.2.2 or later. As a temporary security measure, access to TCP port 8000 should be restricted to trusted hosts only using a firewall or network segmentation. Details are available in the manufacturer's bulletin: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

Siemens TeleControl Server Basic — all versions below V3.1.2.2 with TCP port 8000 accessible.