Summary
TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application's DB, cause denial of service and execute code in an OS shell with limited "NT AUTHORITY\NetworkService" permissions.
Siemens has conducted a root-cause analysis for potential SQL injection vulnerabilities and has identified the locations in the code base where the underlying legacy design pattern has been used in. TeleControl Server Basic V3.1.2.2 has fixed all occurrences in the affected product.
Siemens has released a new version for TeleControl Server Basic and recommends to update to the latest version.
Vulnerabilities 67
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
Critical 9.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
-
High 8.8
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is …
Revision history
-
#2
Revision - Fixing typos
-
#1
Publication Date
References
-
SSA-443402: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-443402.html
-
ICS Advisory ICSA-25-112-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B