Siemens TeleControl Server Basic
view advisory published 2025-10-14
TeleControl Server Basic V3.1 contains an information disclosure vulnerability that could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service. Siemens has released a new version for TeleControl Server Basic V3.1 and recommends to update to the latest version.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-40765US | —OT elevated | — | ||
A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerabilit… | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-062309: Information Disclosure Vulnerability in TeleControl Server Basic V3.1 - CSAF Versionself
- SSA-062309: Information Disclosure Vulnerability in TeleControl Server Basic V3.1 - HTML Versionself
- ICS Advisory ICSA-25-289-09 JSONself
- ICS Advisory ICSA-25-289-09 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (2)
- MitigationTeleControl Server Basic V3.1
Restrict access to port 8000 on the affected systems to trusted IP addresses only
- FixedTeleControl Server Basic V3.1
Update to V3.1.2.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109995705/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan