Siemens 2025: Missing Authentication Flaw in TeleControl Server Threatens Industrial Security
In October 2025, Siemens disclosed a critical authentication vulnerability (CVE-2025-40765) affecting TeleControl Server Basic V3.1 (versions before V3.1.2.3). The flaw, rated CVSS 9.3/10, allows remote, unauthenticated attackers to obtain user password hashes and perform authenticated actions on the database service. The vulnerability exposes critical manufacturing infrastructure worldwide, potentially enabling attackers to manipulate or disrupt automated industrial processes by escalating privileges. Siemens and CISA provided immediate mitigations, including patching and network access controls. This incident highlights the persistent risks from missing authentication controls in OT/ICS applications, at a time when remote exploitation targeting critical infrastructure is rapidly rising. The disclosure underscores the importance of timely patch management and network segmentation for industrial environments facing evolving cyber threats.
Kill Chain