What is CVE-2025-40765?

CVE-2025-40765 is a critical-severity vulnerability in Siemens Telecontrol Server Basic, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-10-14.

How severe is CVE-2025-40765?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Siemens Telecontrol Server Basic

CVE-2025-40765

A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3.1.2.3). The affected application contains an information disclosure vulnerability. This could allow an unauthenticated remote attacker to obtain password hashes of users and to login to and perform authenticated operations of the database service.

Vulnerability class: Broken Authentication

EPSS: 0.005 (41.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Siemens Telecontrol_server_basic — versions 3.1.2.2
Siemens Telecontrol Server Basic V3.1 — versions V3.1.2.2

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

productcert@siemens.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-40765?: CVE-2025-40765 is a critical-severity vulnerability in Siemens Telecontrol Server Basic, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-10-14.
How severe is CVE-2025-40765?: Critical severity. CVSS v3 base score is 9.8 out of 10.