VDB
CVE-2025-27540
CVE-2025-27540
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'Authenticate' method. This could allow an unauthenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25913)
EPSS 0.05% · 16.9th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.05%
16.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| siemens | telecontrol_server_basic | 0 |
| Siemens | TeleControl Server Basic | 0 |
Timeline
- Apr 16, 2025 CVE Published
- Apr 17, 2025 EPSS Score
- Apr 17, 2025 CVE Updated
- Apr 22, 2025 PoC Published
- Apr 27, 2025 Coalition ESS Score
- Apr 29, 2025 EPSS Score
- May 12, 2025 EPSS Score
- May 24, 2025 EPSS Score
- May 24, 2025 Coalition ESS Score
- May 26, 2025 Coalition ESS Score
- Jun 5, 2025 EPSS Score
- Jun 16, 2025 PoC Published