CRITICAL🇵🇱 Wersja polska

CVE-2025-40765

CVSS 9.3v4.0pub. 2025-10-14upd. 2025-10-21

A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The application lacks the required authentication mechanism before exposing sensitive data (CWE-306). An unauthenticated remote attacker can access a resource disclosing user password hashes without providing any credentials. The obtained hashes can be used directly or subjected to password cracking attacks, which opens the way to full authentication in the database service.

Impact

An attacker can obtain password hashes of user accounts, log in to the database service, and execute arbitrary operations requiring permissions in its context, which may lead to data disclosure, modification, or deletion.

Mitigation & patch

Siemens TeleControl Server Basic must be updated to version V3.1.2.3 or later. Patch details are available in the vendor's advisory: https://cert-portal.siemens.com/productcert/html/ssa-062309.html

Who is affected

Siemens TeleControl Server Basic V3.1 — all versions >= V3.1.2.2 and < V3.1.2.3

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X