CVE-2025-32475: Siemens Telecontrol Server Basic SQLi

CVE-2025-32475 Overview

CVE-2025-32475 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateProject method, which fails to properly sanitize input before constructing SQL statements. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 to address the issue, which was reported through the Zero Day Initiative as ZDI-CAN-25912.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary SQL and run code with NT AUTHORITY\NetworkService privileges on the host running TeleControl Server Basic.

Affected Products

Siemens TeleControl Server Basic, all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
SCADA environments using TeleControl Server Basic for RTU project management

Discovery Timeline

2025-04-16 - CVE-2025-32475 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32475

Vulnerability Analysis

The vulnerability exists in the UpdateProject method exposed by the TeleControl Server Basic application listening on TCP port 8000. The method incorporates client-supplied parameters into a SQL statement without applying parameterized queries or input sanitization. An authenticated attacker can inject arbitrary SQL syntax through this method to manipulate the underlying database.

Because UpdateProject is reachable post-authentication but lacks server-side authorization checks for the project context, attackers can escape the intended access scope. SQL injection in the host database engine allows execution of stacked statements, including procedures such as xp_cmdshell when enabled, leading to operating system command execution under the service account.

The TeleControl Server Basic process runs as NT AUTHORITY\NetworkService, so any code triggered through the database tier inherits those privileges. Attackers can use this access to pivot toward connected remote terminal units and engineering workstations within the industrial control network.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The UpdateProject method concatenates untrusted input directly into a SQL statement instead of binding parameters, allowing injected fragments to alter query intent.

Attack Vector

Exploitation requires network reachability to port 8000 and valid application credentials. The attacker sends a crafted request invoking UpdateProject with SQL payloads in the affected parameter. Public technical details for the injection payload are limited; refer to the Siemens Security Advisory SSA-443402 for vendor guidance.

Detection Methods for CVE-2025-32475

Indicators of Compromise

Unexpected child processes spawned from the TeleControl Server Basic service or its database engine running as NT AUTHORITY\NetworkService
Anomalous UpdateProject invocations from non-engineering hosts or outside normal operating hours
Database audit entries showing schema or data changes that do not correspond to a sanctioned project update
New or modified stored procedures and unexpected enabling of features such as xp_cmdshell

Detection Strategies

Inspect application and database logs for SQL syntax tokens such as ;, --, UNION, or xp_ arriving through the UpdateProject parameter set
Baseline expected callers of port 8000 and alert on connections from hosts outside the engineering subnet
Monitor authentication events for the TeleControl application and correlate failed logins followed by successful UpdateProject calls

Monitoring Recommendations

Forward TeleControl Server Basic logs and Windows Security events to a central SIEM for correlation with network telemetry
Enable SQL Server auditing on the database backing TeleControl Server Basic and retain logs for incident review
Alert on process creation events where sqlservr.exe or the TeleControl service spawns cmd.exe, powershell.exe, or other shells

How to Mitigate CVE-2025-32475

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens advisory SSA-443402
Restrict network access to TCP port 8000 so it is reachable only from trusted engineering workstations
Rotate application credentials and review accounts authorized to call UpdateProject
Audit the TeleControl database for unauthorized schema changes, new logins, or enabled extended stored procedures

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address CVE-2025-32475. Customers should follow the upgrade procedure in the Siemens Security Advisory SSA-443402.

Workarounds

Place TeleControl Server Basic behind a firewall that blocks port 8000 from general corporate and untrusted networks
Apply Siemens operational guidelines for industrial security and segment the control network from IT zones
Disable unused database features such as xp_cmdshell on the SQL backend to limit post-injection impact
Limit application accounts to the minimum privileges required and disable accounts that do not need project update capability

bash

# Configuration example: restrict access to TeleControl Server Basic port 8000
# Windows Defender Firewall rule allowing only the engineering subnet
New-NetFirewallRule -DisplayName "TeleControl Server Basic - Restrict 8000" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "TeleControl Server Basic - Block 8000 Default" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -Action Block