External risk intelligence

TeleControl Server Basic Information Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-40765

TeleControl Server Basic is an industrial control system software designed for internal operational technology (OT) monitoring and automation environments. While it supports network communication, it is typically deployed within isolated or protected industrial networks rather than directly exposed to the public internet.

Missing Authentication

Siemens Telecontrol Server Basic

3.1.2.2

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Siemens TeleControl Server Basic software that could allow unauthenticated remote attackers to access user credentials and perform unauthorized actions on the database. This type of software is typically used in industrial control systems, and its potential exposure requires careful review.

Unauthenticated access to critical system credentials.
Industrial control systems can be highly sensitive.
Confirm relevance and assess potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access could exploit this vulnerability by sending a crafted request to the TeleControl Server Basic. This could lead to the disclosure of sensitive user password hashes, potentially allowing the attacker to gain unauthorized access to the database service and perform authenticated operations.

Unauthenticated network access required.
Crafted requests trigger information disclosure.
Risk: unauthorized database access and operations.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in TeleControl Server Basic could allow an unauthenticated remote attacker to obtain user password hashes. When supported, this exposure could enable the attacker to log into the database service and perform authenticated operations.

User password hashes at risk.
Obtained via network unauthenticated.
Unauthorized database access possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Siemens Telecontrol Server Basic and is likely managed by the industrial control system (ICS) or operational technology (OT) team, with potential involvement from the cybersecurity and vendor management teams. The first critical step is to identify all instances of the affected software, determine their network exposure and business criticality, and then assign an owner to initiate a risk-based remediation plan.

ICS/OT teams own the issue.
Verify network exposure and criticality.
Plan remediation with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Siemens TeleControl Server Basic?

TeleControl Server Basic is an industrial software application used to manage data and communication within operational technology (OT) environments. It acts as a central hub for monitoring and controlling remote terminal units in infrastructure systems, essentially bridging the gap between field devices and central control centers.

What does CVE-2025-40765 mean for my security?

This is an information disclosure vulnerability, classified under CWE-306 for missing authentication. In plain terms, the software fails to verify who is requesting data, allowing an unauthorized person to obtain user password hashes. Once these hashes are stolen, an attacker could potentially impersonate a legitimate user to access and manipulate the system's database.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specifically crafted network request to the server. Because the system does not require authentication, the attacker does not need prior access or a valid account to initiate this request. Simply interacting with the vulnerable service over the network is sufficient; standard operational traffic that does not contain this specific malicious request will not trigger the flaw.

Is my system at risk if it is not on the internet?

According to Halo Surface Signal, this software is typically deployed within isolated or protected industrial networks, making it unlikely to be directly exposed to the public internet. However, if your network configuration allows even internal, unauthorized devices to reach the server, the risk remains. You should prioritize checking if your deployment is segmented from broader, less secure corporate networks.

What should I do to respond to this issue?

Start by identifying all instances of TeleControl Server Basic within your organization. Confirm which versions are currently running and map out their specific network connectivity. Once you have an inventory, coordinate with your industrial control systems or OT security teams to assess the business impact and begin planning a risk-based remediation strategy, which may include vendor-provided updates.

References

cert-portal.siemens.com/productcert/html/ssa-062309.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.