Overview
TeleControl Server Basic, a widely used industrial control system (ICS) software, has a critical vulnerability that threatens the integrity of systems running any version prior to V3.1.2.2. CVE-2025-32870, with a significant CVSS score of 8.8, reveals a concerning weakness in the ‘GetTraces’ method, which is prone to SQL injection attacks. This vulnerability is particularly notable due to its potential to enable an authenticated remote attacker to bypass authorization controls, execute malicious scripts, and potentially lead to a system compromise or data leak.
Vulnerability Summary
CVE ID: CVE-2025-32870
Severity: High (8.8 CVSS score)
Attack Vector: Network
Privileges Required: Low
User Interaction: Required
Impact: Bypassing of Authorization Controls, Data leakage, System Compromise
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
TeleControl Server Basic | All versions < V3.1.2.2 How the Exploit Works
The exploit takes advantage of a SQL Injection vulnerability in the ‘GetTraces’ method of the TeleControl Server Basic application. An attacker who has authenticated access to the system can send a specially crafted SQL query to the application via port 8000. This can allow the attacker to manipulate the database by reading from it, writing to it, or even executing code with “NT AUTHORITYNetworkService” permissions.
Conceptual Example Code
Here’s a conceptual example of what a malicious SQL injection might look like:
POST /GetTraces HTTP/1.1
Host: target.example.com:8000
Content-Type: application/sql
{ "query": "SELECT * FROM Users; DROP TABLE Users;" }In this example, the ‘DROP TABLE Users;’ command would delete the entire ‘Users’ table from the database if successfully executed, demonstrating the potential severity of this vulnerability.
Mitigation
Users of TeleControl Server Basic are strongly advised to update to the latest version (V3.1.2.2 or later) as soon as possible. If an immediate update is not feasible, a temporary mitigation measure involves the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and filter out potentially harmful SQL queries.