CVE-2025-32870: SQL Injection Vulnerability in TeleControl Server Basic

Overview

TeleControl Server Basic, a widely used industrial control system (ICS) software, has a critical vulnerability that threatens the integrity of systems running any version prior to V3.1.2.2. CVE-2025-32870, with a significant CVSS score of 8.8, reveals a concerning weakness in the ‘GetTraces’ method, which is prone to SQL injection attacks. This vulnerability is particularly notable due to its potential to enable an authenticated remote attacker to bypass authorization controls, execute malicious scripts, and potentially lead to a system compromise or data leak.

Vulnerability Summary

CVE ID: CVE-2025-32870
Severity: High (8.8 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Bypassing of Authorization Controls, Data leakage, System Compromise

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The exploit takes advantage of a SQL Injection vulnerability in the ‘GetTraces’ method of the TeleControl Server Basic application. An attacker who has authenticated access to the system can send a specially crafted SQL query to the application via port 8000. This can allow the attacker to manipulate the database by reading from it, writing to it, or even executing code with “NT AUTHORITYNetworkService” permissions.

Conceptual Example Code

Here’s a conceptual example of what a malicious SQL injection might look like:

POST /GetTraces HTTP/1.1
Host: target.example.com:8000
Content-Type: application/sql
{ "query": "SELECT * FROM Users; DROP TABLE Users;" }

In this example, the ‘DROP TABLE Users;’ command would delete the entire ‘Users’ table from the database if successfully executed, demonstrating the potential severity of this vulnerability.

Mitigation

Users of TeleControl Server Basic are strongly advised to update to the latest version (V3.1.2.2 or later) as soon as possible. If an immediate update is not feasible, a temporary mitigation measure involves the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and filter out potentially harmful SQL queries.