CVE-2025-32860: SQL Injection Vulnerability in TeleControl Server Basic

Overview

The world of cybersecurity is continuously evolving, and a recent vulnerability, CVE-2025-32860, has been identified in TeleControl Server Basic. This vulnerability, which affects all versions of the application prior to V3.1.2.2, allows for SQL injection through the internally used ‘UnlockWebServerGatewaySettings’ method. This could potentially allow an authenticated remote attacker to bypass authorization controls, read from and write to the application’s database, and execute code with “NT AUTHORITYNetworkService” permissions. This vulnerability is severe due to its potential to compromise systems and cause data leakage.

Vulnerability Summary

CVE ID: CVE-2025-32860
Severity: High (8.8 CVSS Score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works

The vulnerability exists due to insufficient input validation in the ‘UnlockWebServerGatewaySettings’ method. This method, which is internally used by the application, does not effectively sanitize user input and can be manipulated through SQL injection. An attacker, after gaining network access and authenticating themselves, can pass malicious SQL statements to manipulate the application’s database. They can bypass authorization controls, read from and write to the database, and even execute code with “NT AUTHORITY\NetworkService” permissions.

Conceptual Example Code

Below is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP request:

POST /UnlockWebServerGatewaySettings HTTP/1.1
Host: vulnerable.server.com
Content-Type: application/sql
{ "settings": "'; DROP TABLE users; --" }

In the above example, the attacker is sending a malicious SQL statement (`DROP TABLE users;`) to the server, which could potentially lead to data loss if the ‘users’ table exists.
Please note that this is a conceptual example and might not work as-is. The actual exploit would depend on the specific implementation of the ‘UnlockWebServerGatewaySettings’ method and the structure of the application’s database.