CVE-2025-29931: Medium severity telecontrol server basic vulnerability
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a serialized message which it uses to determine the amount of memory to be allocated for deserialization. This could allow an unauthenticated remote attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of service condition. Successful exploitation is only possible in redundant Telecontrol Server Basic setups and only if the connection between the redundant servers has been disrupted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-29931?
CVE-2025-29931 has been classified with a severity rating that indicates a significant risk due to potential unauthorized access and memory allocation issues.
How do I fix CVE-2025-29931?
To mitigate CVE-2025-29931, upgrade TeleControl Server Basic to version 3.1.2.2 or later.
What are the risks associated with CVE-2025-29931?
The risks of CVE-2025-29931 include possible denial of service and unauthorized access due to improper memory allocation.
Is authentication required to exploit CVE-2025-29931?
No, exploitation of CVE-2025-29931 does not require authentication, which increases its risk potential.
What versions of TeleControl Server Basic are affected by CVE-2025-29931?
All versions of TeleControl Server Basic prior to version 3.1.2.2 are affected by CVE-2025-29931.