CVE-2025-27495: Siemens Telecontrol Server Basic SQLi

CVE-2025-27495 Overview

A critical SQL injection vulnerability has been identified in Siemens TeleControl Server Basic, affecting all versions prior to V3.1.2.2. The vulnerability exists in the internally used CreateTrace method, which fails to properly sanitize user input before constructing SQL queries. This flaw allows an unauthenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute arbitrary code with "NT AUTHORITY\NetworkService" permissions.

Successful exploitation requires the attacker to have network access to port 8000 on a system running a vulnerable version of the application. This vulnerability was assigned the identifier ZDI-CAN-25911 by the Zero Day Initiative.

Critical Impact

Unauthenticated remote attackers can achieve full database compromise and remote code execution with NetworkService privileges through SQL injection in the CreateTrace method.

Affected Products

• Siemens TeleControl Server Basic (All versions < V3.1.2.2)

Discovery Timeline

• April 16, 2025 - CVE-2025-27495 published to NVD
• August 19, 2025 - Last updated in NVD database

Technical Details for CVE-2025-27495

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a well-documented weakness where user-controllable input is incorporated into SQL queries without proper sanitization or parameterization. The CreateTrace method within TeleControl Server Basic constructs database queries using unsanitized input, creating a direct pathway for attackers to inject malicious SQL statements.

The impact is severe because successful exploitation grants attackers three distinct capabilities: reading sensitive data from the database (information disclosure), modifying database contents (data integrity compromise), and executing operating system commands through SQL Server's extended stored procedures with "NT AUTHORITY\NetworkService" permissions. This combination effectively provides attackers with both data exfiltration capabilities and a foothold for lateral movement within the network.

The network-accessible nature of port 8000, combined with the absence of authentication requirements, makes this vulnerability particularly dangerous in environments where the affected service is exposed to untrusted networks.

Root Cause

The root cause lies in the CreateTrace method's failure to implement proper input validation and parameterized queries. Instead of using prepared statements or stored procedures with bound parameters, the application directly concatenates user-supplied input into SQL query strings. This architectural flaw is a common pattern in legacy applications and represents a fundamental violation of secure coding practices for database interactions.

Attack Vector

The attack vector is network-based, requiring the attacker to reach port 8000 on a vulnerable system. No authentication is required, and no user interaction is needed for exploitation. An attacker can craft malicious requests containing SQL injection payloads targeting the CreateTrace method. The injected SQL can include commands to extract database contents, modify records, or leverage SQL Server features like xp_cmdshell to execute operating system commands.

The vulnerability allows attackers to chain SQL injection with command execution, escalating from database access to full system compromise with NetworkService privileges. This privilege level, while not SYSTEM, still provides significant capabilities for persistence and lateral movement within Windows environments.

Detection Methods for CVE-2025-27495

Indicators of Compromise

• Unusual or malformed requests to port 8000 containing SQL metacharacters such as single quotes, semicolons, or SQL keywords (UNION, SELECT, INSERT, xp_cmdshell)
• Database audit logs showing unexpected queries or access patterns from the TeleControl Server Basic application context
• Process creation events showing cmd.exe or PowerShell spawned as child processes of the TeleControl Server Basic service with "NT AUTHORITY\NetworkService" context
• Unexpected outbound network connections from the TeleControl Server Basic process

Detection Strategies

• Deploy network-based intrusion detection rules monitoring traffic to port 8000 for SQL injection patterns and payloads
• Enable SQL Server auditing to capture and alert on suspicious query patterns, especially those involving system stored procedures like xp_cmdshell
• Implement endpoint detection rules to identify command execution chains originating from the TeleControl Server Basic service process
• Monitor Windows Security Event logs for process creation events (Event ID 4688) showing unexpected child processes under the NetworkService account

Monitoring Recommendations

• Establish baseline network traffic patterns for port 8000 and alert on anomalies in request volume or content
• Configure SIEM correlation rules to detect the combination of SQL injection attempts followed by command execution indicators
• Implement file integrity monitoring on critical TeleControl Server Basic directories and configuration files
• Review database transaction logs periodically for signs of data exfiltration or unauthorized modifications

How to Mitigate CVE-2025-27495

Immediate Actions Required

• Upgrade to Siemens TeleControl Server Basic version V3.1.2.2 or later immediately
• If immediate patching is not possible, restrict network access to port 8000 using firewall rules to allow only trusted management hosts
• Implement network segmentation to isolate TeleControl Server Basic systems from untrusted network segments
• Enable comprehensive logging on affected systems and monitor for exploitation attempts

Patch Information

Siemens has released TeleControl Server Basic version V3.1.2.2 to address this vulnerability. Organizations should apply this update as soon as possible following their change management procedures. Detailed patch information and download links are available in the Siemens Security Advisory SSA-443402.

Workarounds

• Block or restrict access to port 8000 at the network perimeter and internal firewalls to prevent external exploitation
• Deploy a web application firewall (WAF) or intrusion prevention system (IPS) with SQL injection detection rules in front of the TeleControl Server Basic service
• Implement network-level access controls to ensure only authorized systems can communicate with the affected service
• Consider temporarily disabling the affected service if it is not critical to operations until patching can be completed

# Windows Firewall rule to restrict port 8000 access to specific management IP
netsh advfirewall firewall add rule name="Block TeleControl 8000" dir=in action=block protocol=tcp localport=8000
netsh advfirewall firewall add rule name="Allow TeleControl 8000 Management" dir=in action=allow protocol=tcp localport=8000 remoteip=10.0.0.100