CVE-2025-31349CWE-89

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2)

High · published April 16, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injection through the internally used 'UpdateSmtpSettings' method. This could allow an authenticated remote attacker to bypass authorization controls, to read from and write to the application's database and execute code with "NT AUTHORITY\NetworkService" permissions. A successful attack requires the attacker to be able to access port 8000 on a system where a vulnerable version of the affected application is executed on. (ZDI-CAN-25919)

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00880 · 58.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-04-16T17:37Z
EPSS history
Timeline
  • 16 APR 17:37Z
    A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2)
    cvelistv5