CVE-2025-40765 - A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3) · CoreCVE

Back Back to CVE browser

CRITICAL

A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3)

Published Oct 14, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.53%

Description

A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.

Affected products

Vendor Siemens Product TeleControl Server Basic V3.1 Default
n/a
- Version
  V3.1.2.2
  Status
  affected
  Constraints
  <V3.1.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TeleControl Server Basic V3.1

n/a

Version	Status	Constraints
V3.1.2.2	affected	<V3.1.2.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (2)

https://cert-portal.siemens.com/productcert/html/ssa-062309.html
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34161
Advisory

Link	Providers	Tags
https://cert-portal.siemens.com/productcert/html/ssa-062309.html		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-34161		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner siemens

Published Oct 14, 2025

Updated Oct 14, 2025

Reserved Apr 16, 2025

Link CVE-2025-40765

CISA Vulnrichment

Updated Oct 14, 2025

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-40765

Severity n/a

Public date n/a

Links CVE-2025-40765

Assigner siemens

Published Oct 14, 2025

Updated Oct 14, 2025

Exploited since n/a

Link EUVD-2025-34161

EUVD-2025-34161