CVE-2025-29931
First published: Thu Apr 17 2025(Updated: )
A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected product does not properly validate a length field in a serialized message which it uses to determine the amount of memory to be allocated for deserialization. This could allow an unauthenticated remote attacker to cause the application to allocate exhaustive amounts of memory and subsequently create a partial denial of service condition. Successful exploitation is only possible in redundant Telecontrol Server Basic setups and only if the connection between the redundant servers has been disrupted.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TeleControl Server Basic | <3.1.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-29931?
CVE-2025-29931 has been classified with a severity rating that indicates a significant risk due to potential unauthorized access and memory allocation issues.
How do I fix CVE-2025-29931?
To mitigate CVE-2025-29931, upgrade TeleControl Server Basic to version 3.1.2.2 or later.
What are the risks associated with CVE-2025-29931?
The risks of CVE-2025-29931 include possible denial of service and unauthorized access due to improper memory allocation.
Is authentication required to exploit CVE-2025-29931?
No, exploitation of CVE-2025-29931 does not require authentication, which increases its risk potential.
What versions of TeleControl Server Basic are affected by CVE-2025-29931?
All versions of TeleControl Server Basic prior to version 3.1.2.2 are affected by CVE-2025-29931.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/source
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/event
- vendor/telecontrol
- canonical/telecontrol server basic