CVE-2025-32859: SQL Injection Vulnerability in TeleControl Server Basic

Overview

This blog post will examine a critical vulnerability, identified as CVE-2025-32859, that affects TeleControl Server Basic, a popular application used in telecommunication infrastructures. The vulnerability, which involves SQL injection through an internally used method, exposes users to potential attacks that can compromise their systems and lead to significant data leakage. Addressing this vulnerability is of high importance due to the potential damage and the broad user base of the affected application.

Vulnerability Summary

CVE ID: CVE-2025-32859
Severity: High – CVSS Score 8.8
Attack Vector: Network
Privileges Required: Low (authenticated remote access)
User Interaction: None
Impact: System compromise, data leakage, and unauthorized execution of code

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The exploit leverages an SQL injection vulnerability. An attacker who has authenticated remote access can bypass authorization controls via the ‘LockWebServerGatewaySettings’ method. This method, which is internally used by the application, is vulnerable to SQL injection, allowing the attacker to manipulate the application’s database.
The intruder can read and write to the application’s database and execute code with “NT AUTHORITY\NetworkService” permissions. This level of access can lead to a system compromise, including unauthorized data access and potential data leakage. The attack requires the vulnerable version of the application to be running and accessible via port 8005.

Conceptual Example Code

Here is a conceptual example of how an attacker might exploit this vulnerability:

POST /LockWebServerGatewaySettings HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"query": "SELECT * FROM Users WHERE UserID='1' OR '1'='1';--"
}

In this example, the attacker injects malicious SQL code into the ‘LockWebServerGatewaySettings’ method, causing the application to return data it shouldn’t. The impact can be severe, leading to system compromise, data leakage, and unauthorized code execution.

Mitigation Guidance

TeleControl has released a patch (version V3.1.2.2) that addresses this vulnerability. Users are strongly advised to update their systems to this or a later version. As a temporary measure, users can also implement a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block malicious traffic exploiting this vulnerability. However, these measures are only temporary and cannot substitute for the application of the vendor-released patch.