CVE-2025-27539 is a critical SQL injection vulnerability affecting all versions of Siemens TeleControl Server Basic prior to V3.1.2.2. An unauthenticated remote attacker can exploit this flaw by accessing port 8000, bypassing authorization, and gaining full read/write access to the application's database, potentially leading to code execution with NT AUTHORITY\NetworkService privileges. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, resulting in complete compromise of confidentiality, integrity, and availability. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), nor is it listed on the KEV catalog, and it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.1.2.2CPE matchmatch criteria | cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:* | ||
>= 0, < V3.1.2.2CPE match | cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.