Multiple Vulnerabilities in Telecontrol Server Basic before V3.1.2.0

Act Now8.8SSA-556635Apr 9, 2024

Attack VectorNetwork

Auth RequiredLow

ComplexityLow

User InteractionNone needed

Summary

TeleControl Server Basic V3 before V3.1.2.0 contains multiple vulnerabilities across memory management (CWE-415, CWE-416, CWE-119), integer handling (CWE-190), cryptography (CWE-326, CWE-311, CWE-295), path traversal (CWE-22, CWE-73), input validation (CWE-20), and null pointer handling (CWE-476, CWE-754, CWE-1333). These flaws allow an authenticated user to read confidential data, modify operations, or cause denial of service on the TeleControl server.

What this means

What could happen

Multiple vulnerabilities in TeleControl Server Basic could allow an authenticated attacker to read sensitive data, modify system behavior, or crash the server. The affected device controls remote SCADA operations, so exploitation could disrupt monitoring and control of substations, generation facilities, or critical infrastructure networks.

Who's at risk

Operators of SCADA systems, utility control centers, and substations using Siemens TeleControl Server Basic for remote device management and monitoring should prioritize this update. Any site relying on this software for remote RTU or IED communication across wide-area networks is affected.

How it could be exploited

An attacker with valid login credentials to the TeleControl Server Basic web interface could send specially crafted requests to trigger memory corruption, path traversal, integer overflow, or weak cryptography flaws. By chaining these vulnerabilities, the attacker could execute commands on the server with the same privileges as the service, potentially allowing them to alter operator commands or inject malicious data into the control channel.

Prerequisites

Valid login credentials to TeleControl Server Basic web interface
Network access to the TeleControl Server Basic on port 80 or 443
Target device running version 3.1.2.0 or earlier

remotely exploitablerequires valid credentialslow complexity attackhigh EPSS score (88.5%)affects SCADA/control operationsmultiple vulnerability classes

Exploitability

High exploit probability (EPSS 88.5%)

Affected products (1)

ProductAffected VersionsFix Status

TeleControl Server Basic V3<V3.1.23.1.2

Remediation & Mitigation

0/1

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate TeleControl Server Basic to version 3.1.2 or later

CVEs (47)

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/637889e9-ad33-4c4a-8ea1-848593b9fe1d