77 matches found
CVE-2021-45117
CVE-2021-45117 concerns the OPC UA ANSI C stack stubs in the NodeSets. The root cause is a NULL pointer dereference caused by not handling all error cases in generated code, potentially crashing an OPC UA client (and possibly a server in certain usage). The vulnerability is reported with a CVSSv3...
CVE-2019-6575
CVE-2019-6575 affects Siemens industrial products using OPC UA, including SIMATIC CP443-1 OPC UA, ET 200 Open Controller CPU 1515SP PC2, HMI Outdoor Panels (7"/15"), HMI Comfort Panels (4"–22"), KTP Mobile Panels, IPC DiagMonitor, NET PC Software, RF188C, RF600R, S7‑1500 family, WinCC OA/Runtime,...
CVE-2021-40142
In the OPC Foundation Local Discovery Server (LDS), versions before 1.04.402.463 are vulnerable to a DoS caused by crafted messages that trigger an access to memory location after the end of a buffer (CVE-2021-40142). The issue affects LDS and related Siemens products listed in ICS/CISA advisorie...
CVE-2025-32854
TeleControl Server Basic (all versions
CVE-2025-32872
TeleControl Server Basic (Siemens) prior to v3.1.2.2 contains SQL injection in the GetOverview path, enabling an authenticated remote attacker to bypass authorization, read/write the database and execute code with NT AUTHORITY\NetworkService permissions. Attack requires access to port 8000 where ...
CVE-2025-32864
TeleControl Server Basic (versions before 3.1.2.2) is vulnerable to SQL injection in the GetSettings path, allowing an authenticated user to bypass authorization, read/write DB data, and execute code with NT AUTHORITY\NetworkService. Multiple sources corroborate injection across various internal ...
CVE-2025-32870
CVE-2025-32870 affects TeleControl Server Basic (versions before 3.1.2.2). A SQL injection via the internal GetTraces method can bypass authorization, enabling reading/writing the application database and executing code with NT AUTHORITY\NetworkService. The attack requires network access to port ...
CVE-2025-32851
CVE-2025-32851 affects Siemens TeleControl Server Basic prior to 3.1.2.2. The vulnerability is an SQL injection in the internal method UnlockTcmSettings, enabling an authenticated remote attacker to bypass authorization, read/write the application’s database, and execute code with NT AUTHORITY\Ne...
CVE-2025-32822
CVE-2025-32822 affects Siemens TeleControl Server Basic (all versions
CVE-2025-32868
CVE-2025-32868 affects Siemens TeleControl Server Basic prior to v3.1.2.2. An SQL injection via the internal ExportCertificate method can let an attacker read/write the database and execute code with NT AUTHORITY\NetworkService privileges, given network access to port 8000. Multiple sources confi...
CVE-2025-32869
TeleControl Server Basic (versions
CVE-2025-32867
The CVE-2025-32867 issue affects TeleControl Server Basic (versions prior to 3.1.2.2). A SQL injection vulnerability exists in the CreateBackup method that can allow an authenticated remote attacker to bypass authorization and read from/write to the database, potentially executing code with NT AU...
CVE-2025-32856
Summary : CVE-2025-32856 affects Siemens TeleControl Server Basic before v3.1.2.2. The vulnerability is an SQL injection in the internal LockBufferingSettings path (and related methods listed in advisories) that can let an authenticated remote attacker bypass authorization, read/write the applica...
CVE-2025-27495
CVE-2025-27495 affects Siemens TeleControl Server Basic (all versions
CVE-2025-32871
Siemens TeleControl Server Basic (versions before 3.1.2.2) contains SQL injection via the MigrateDatabase path. An authenticated remote attacker who can reach port 8000 can bypass authorization, read/write the application database, and execute code with NT AUTHORITY\NetworkService privileges. Evi...
CVE-2024-44102
Summary: CVE-2024-44102 affects Siemens TeleControl Server Basic (various edition/versions listed in the CVE) where remote attackers can trigger a deserialization of user-supplied content, allowing an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. The root cause is ins...
CVE-2025-32830
The CVE-2025-32830 issue affects TeleControl Server Basic (versions
CVE-2025-32839
CVE-2025-32839 affects Siemens TeleControl Server Basic (versions
CVE-2025-32844
CVE-2025-32844 affects Siemens TeleControl Server Basic (versions before 3.1.2.2). The vulnerability is an SQL injection in the UnlockUser method that can let an authenticated remote attacker bypass authorization, read/write the database, and execute code with NT AUTHORITY\NetworkService privileg...
CVE-2025-32857
CVE-2025-32857 affects Siemens TeleControl Server Basic (all versions
CVE-2025-32860
CVE-2025-32860 affects Siemens TeleControl Server Basic before version 3.1.2.2. The vulnerability is an SQL injection via the internal UnlockWebServerGatewaySettings method, enabling an authenticated remote attacker to bypass authorization, read/write the application database, and execute code wi...
CVE-2025-29931
CVE-2025-29931 affects Siemens TeleControl Server Basic versions prior to 3.1.2.2. The issue arises from insufficient validation of a length field in a serialized message, used to size memory for deserialization, which could allow an unauthenticated remote attacker to force excessive memory alloc...
CVE-2025-30030
Summary (CVE-2025-30030) : TeleControl Server Basic versions prior to 3.1.2.2 are affected by an SQL injection vulnerability in the internal ImportDatabase method. An authenticated remote attacker can bypass authorization, read/write the application database, and execute code with NT AUTHORITY\Ne...
CVE-2025-32826
TeleControl Server Basic (all versions
CVE-2025-32829
TeleControl Server Basic (versions
CVE-2025-32847
TeleControl Server Basic (versions prior to 3.1.2.2) is affected by an SQL injection in the UnlockGeneralSettings path, allowing an authenticated remote actor to bypass authorization, read/write the app’s DB, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability requires...
CVE-2025-32832
CVE-2025-32832 affects Siemens TeleControl Server Basic (versions
CVE-2025-32853
TeleControl Server Basic (versions before 3.1.2.2) is vulnerable to SQL injection via the internal UnlockDatabaseSettings method. An authenticated remote attacker who can access port 8000 can bypass authorization, read/write the application database, and execute code with NT AUTHORITY\NetworkServ...
CVE-2025-32862
CVE-2025-32862 concerns Siemens TeleControl Server Basic. Affected: all versions
CVE-2025-31351
CVE-2025-31351 affects Siemens TeleControl Server Basic (all versions
CVE-2025-32475
The CVE-2025-32475 entry affects Siemens TeleControl Server Basic before version 3.1.2.2. The vulnerability is a SQL injection in the internal UpdateProject path that can let an authenticated remote attacker bypass authorization, read/write the app DB, and execute code with NT AUTHORITY\NetworkSe...
CVE-2025-32845
CVE-2025-32845 concerns Siemens TeleControl Server Basic. The vulnerability is an SQL injection in the internal UpdateGeneralSettings method of all versions earlier than 3.1.2.2. An authenticated remote attacker who can reach port 8000 could bypass authorization, read/write the application’s data...
CVE-2025-32849
TeleControl Server Basic (All versions
CVE-2025-32859
The CVE-2025-32859 entry concerns Siemens TeleControl Server Basic prior to version V3.1.2.2, which is vulnerable to SQL injection via the internal LockWebServerGatewaySettings method. An authenticated attacker who can reach port 8000 can bypass authorization and read/write the application databa...
CVE-2025-32861
CVE-2025-32861 (TeleControl Server Basic) : The Siemens TeleControl Server Basic product is affected in all versions before 3.1.2.2 by a SQL injection in the internal UpdateTraceLevelSettings path, allowing an authenticated remote attacker to bypass authorization, read/write the application datab...
CVE-2025-32836
Siemens TeleControl Server Basic (versions
CVE-2025-32840
CVE-2025-32840 affects Siemens TeleControl Server Basic (versions
CVE-2025-32852
Siemens TeleControl Server Basic versions before V3.1.2.2 are susceptible to SQL injection via the internal LockDatabaseSettings path, potentially allowing an authenticated attacker to bypass authorization, read/write the database, and execute code with NT AUTHORITY\NetworkService privileges. Exp...
CVE-2025-32866
CVE-2025-32866 affects Siemens TeleControl Server Basic (all versions
CVE-2025-30031
The CVE-2025-30031 entry concerns Siemens TeleControl Server Basic prior to v3.1.2.2, with a SQL injection in the internal UpdateUsers method. This can allow an authenticated remote attacker to bypass authorization, read/write the application’s database, and execute code with NT AUTHORITY\Network...
CVE-2025-32825
Vulnerability summary: TeleControl Server Basic (Siemens) versions prior to 3.1.2.2 suffer an SQL injection in the internal GetProjects method. This can let an authenticated remote attacker bypass authorization, read/write the database, and execute code with NT AUTHORITY\NetworkService permission...
CVE-2025-32848
CVE-2025-32848 affects Siemens TeleControl Server Basic (versions before 3.1.2.2). The vulnerability is an SQL injection in the internally used LockSmtpSettings method, allowing an authenticated remote attacker to bypass authorization, read/write the application DB, and execute code with NT AUTHO...
CVE-2025-32858
CVE-2025-32858 affects Siemens TeleControl Server Basic (all versions
CVE-2025-32863
CVE-2025-32863 affects Siemens TeleControl Server Basic prior to v3.1.2.2. The vulnerability is an SQL injection in the UnlockTraceLevelSettings pathway that can allow an authenticated remote attacker to bypass authorization, read/write the application DB, and execute code with NT AUTHORITY\Netwo...
CVE-2025-27540
TeleControl Server Basic is affected by a SQL injection in the internal Authenticate method for all versions prior to 3.1.2.2. The flaw can allow an unauthenticated remote attacker to bypass authorization, read/write the database, and potentially execute code with NT AUTHORITY\NetworkService权限, r...
CVE-2025-32827
CVE-2025-32827 affects Siemens TeleControl Server Basic prior to version 3.1.2.2. The vulnerability is a SQL injection in the internal ActivateProject method that can let an authenticated remote attacker bypass authorization, read/write the database, and execute code with NT AUTHORITY\NetworkServ...
CVE-2025-32831
The CVE-2025-32831 flaw affects Siemens TeleControl Server Basic (versions prior to 3.1.2.2), with SQL injection via the internal UpdateProjectUserRights method. Attackers authenticated to the system could read/write the application DB and execute code with NT AUTHORITY\NetworkService permissions...
CVE-2025-29905
CVE-2025-29905 affects Siemens TeleControl Server Basic (versions