Which versions of TeleControl Server Basic are affected by CVE-2025-40765?

A missing-authentication flaw in Siemens TeleControl Server Basic V3.1 (builds V3.1.2.2 up to but not including V3.1.2.3) lets anyone who can reach the service over the network extract user password…

How to fix or mitigate CVE-2025-40765?

Within 24 hours, inventory every TeleControl Server Basic V3.1 deployment, confirm which instances are running builds from V3.1.2.2 up to but not including V3.1.2.3, and immediately restrict network reachability to the service through firewall rules, segmentation, or disabling external exposure; in parallel, rotate database service account credentials and any user passwords whose hashes could have been exposed, since exploitation requires only network reachability to the service and no user interaction. Within 7 days, apply the vendor-released patch by upgrading all affected instances to V3.1.2.3, validate the upgrade completed successfully, rotate any credentials not already changed, and review service and database authentication logs for anomalous access. Within 30 days, confirm no remaining affected builds through a follow-up scan, fold the V3.1.2.3 baseline into patch-management and asset-inventory records, and keep network access to the telecontrol service restricted to trusted zones with monitoring in place for unexpected authentication attempts.

TeleControl Server Basic CVE-2025-40765

Q: What is the CVSS score of CVE-2025-40765?

CVE-2025-40765 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2025-10-14 productcert@siemens.com

Authentication Bypass Information Disclosure Siemens Telecontrol Server Basic

9.3

CVSS 4.0 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network access with low complexity (PR:N/AV:N/AC:L) exposes password hashes enabling full database compromise, so C:H/I:H/A:H and S:U (no cross-system scope change).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (siemens).

CVSS VectorVendor: siemens

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 12:05 vuln.today

CVE Published

Oct 14, 2025 - 10:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.

AnalysisAI

Unauthenticated remote attackers can exploit missing authentication in Siemens TeleControl Server Basic V3.1 builds from V3.1.2.2 up to but not including V3.1.2.3 to extract user password hashes and potentially authenticate to the database service. Exploitation requires only network reachability to the service, with no privileges or user interaction, and the fixed release is V3.1.2.3. No public exploit code or confirmed active exploitation is identified at time of analysis; EPSS is 0.53% (43rd percentile), but the flaw's intrinsic severity (CVSS v4.0 9.3) and OT/ICS context warrant urgent patching.

Technical ContextAI

Siemens TeleControl Server Basic is a telecontrol server used in industrial control and OT environments. The vulnerability falls under CWE-306 (Missing Authentication for Critical Function): the affected V3.1 builds (>= V3.1.2.2, < V3.1.2.3) expose a critical function that permits an unauthenticated network attacker to disclose password hashes and then potentially authenticate to the database service. The CPE cpe:2.3:a:siemens:telecontrol_server_basic:3.1.2.2:*:*:*:*:*:*:* pinpoints the vulnerable build. The CVSS v4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both confirm remote, unauthenticated exploitation with high confidentiality, integrity, and availability impact; however, real-world impact beyond hash disclosure depends on whether the attacker can leverage those hashes against the database service. The low EPSS score (0.53%, percentile 43%) and absence of KEV/POC data suggest no observed exploitation, but the deployment is typically in segmented OT networks that may limit exposure.

RemediationAI

Upgrade to Siemens TeleControl Server Basic V3.1.2.3 or later as directed by Siemens SSA-062309 (https://cert-portal.siemens.com/productcert/html/ssa-062309.html). Until the patch can be applied, restrict network access to the TeleControl Server Basic service and its database service to trusted OT zones using firewall rules or network segmentation; this compensating control reduces exposure to unauthenticated remote attackers but does not fix the underlying missing-authentication flaw and may limit remote management access. If compromise is suspected, rotate database service credentials and review database and application logs for unauthorized authenticated operations. No public exploit was identified at time of analysis, but given the high intrinsic severity and the ICS/OT context, patching should be prioritized.