Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-40765

32
FAUCET Score

CVE-2025-40765 is a critical information disclosure vulnerability affecting Siemens TeleControl Server Basic V3.1 (versions >= V3.1.2.2 < V3.1.2.3). This flaw allows an unauthenticated remote attacker to obtain user password hashes, enabling them to log in and perform authenticated operations on the database service. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness within the cybersecurity community.

Impacted Technologies

VendorProductVersion(s)CPE
3.1.2.2CPE matchmatch criteria
cpe:2.3:a:siemens:telecontrol_server_basic:3.1.2.2:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

9.3CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.52%
Probability of exploitation in next 30 days
EPSS Percentile
41.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0052 is in the 20th percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (6)

3cxvendor investigatingvia llm_extracted
burp_suitevendor investigatingvia llm_extracted
entrustvendor investigatingvia llm_extracted
moxavendor investigatingvia llm_extracted
proxmoxvendor investigatingvia llm_extracted
qwikvendor investigatingvia llm_extracted

Vendor Advisories (6)

proxmoxllm-proxmox-8c9183d43dcc51f8CRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025
moxallm-moxa-6c94dfef0be220e6CRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025
entrustllm-entrust-18cc001c7f1ec3efCRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025
3cxllm-3cx-82e7bb7b276f7476CRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025
burp_suitellm-burp_suite-a7ca551c83bad2f5CRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025
qwikllm-qwik-d7f34f535bbdfb17CRITICAL

Siemens TeleControl Server Basic V3.1.2.2 Password Hash Disclosure

Oct 14, 2025

References

cert-portal.siemens.com / productcert/html/ssa-062309.html
Vendor Advisory