CVE-2025-32823: Siemens Telecontrol Server Basic SQLi

CVE-2025-32823 Overview

CVE-2025-32823 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used LockProject method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify application database content, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is tracked as [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can execute arbitrary code with NT AUTHORITY\NetworkService privileges and gain full read/write access to the TeleControl Server Basic database.

Affected Products

Siemens TeleControl Server Basic, all versions prior to V3.1.2.2
Industrial control environments exposing TCP port 8000
SCADA deployments leveraging Siemens TeleControl for remote site management

Discovery Timeline

2025-04-16 - CVE-2025-32823 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32823

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input in the LockProject method exposed by the TeleControl Server Basic service. The method accepts parameters used to construct SQL statements without parameterization or input validation. An authenticated client invoking this method can inject arbitrary SQL fragments that are concatenated into queries executed against the backend database.

Because the LockProject method is reached after authentication but before authorization decisions are enforced at the data layer, an attacker can use the injection to bypass internal access checks. The service runs as NT AUTHORITY\NetworkService, allowing the attacker to leverage database extension features, such as xp_cmdshell or stored procedures, to execute operating system commands at that privilege level.

Siemens publishes remediation guidance in Siemens Security Advisory SSA-443402.

Root Cause

The root cause is the construction of SQL statements through string concatenation inside the LockProject handler. Input arriving from authenticated remote clients is passed directly into query text rather than being bound through parameterized prepared statements. The component also lacks server-side validation of expected parameter types and lengths.

Attack Vector

Exploitation requires network access to TCP port 8000 on a host running a vulnerable TeleControl Server Basic instance and a valid set of credentials. The attacker calls the internal LockProject method and supplies a crafted parameter containing SQL syntax. The injected SQL executes within the database context used by the application and can be chained with shell execution features to achieve remote code execution. No user interaction is required.

No verified public proof-of-concept code is currently available. Refer to the vendor advisory for protocol-level details.

Detection Methods for CVE-2025-32823

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService
Database audit log entries showing schema reads, writes, or stored procedure execution originating from the application's service account outside normal operational patterns
Anomalous inbound connections to TCP port 8000 from hosts outside the engineering or operations network

Detection Strategies

Inspect application and database logs for LockProject invocations containing SQL meta-characters such as single quotes, semicolons, or comment markers
Monitor for SQL Server xp_cmdshell or sp_OACreate execution attributed to the TeleControl service account
Correlate authentication events on TeleControl with subsequent process creation events on the host to identify deviations from baseline behavior

Monitoring Recommendations

Enable verbose logging on the TeleControl Server Basic application and ship logs to a centralized SIEM for retention and correlation
Alert on any process creation by the TeleControl service whose image path is not on an approved allowlist
Track network flows to and from TCP port 8000 and flag connections sourced from non-trusted segments

How to Mitigate CVE-2025-32823

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens Security Advisory SSA-443402
Restrict network access to TCP port 8000 so that only authorized engineering workstations can reach the service
Rotate credentials used to authenticate to TeleControl Server Basic following the patch
Review the database service account permissions and remove any unnecessary privileges such as xp_cmdshell rights

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which addresses the SQL injection in the LockProject method. Operators should plan an upgrade window in line with their change management process. Until the patch is applied, the workarounds below reduce exposure.

Workarounds

Place the TeleControl Server Basic host behind a firewall and permit TCP/8000 only from explicitly approved management hosts
Segment the operational technology network from corporate and internet-facing networks to limit reachability
Disable or constrain SQL Server features that allow operating system command execution from the database context
Apply Siemens operational guidelines for industrial security and the defense-in-depth recommendations referenced in the advisory

bash

# Example Windows Firewall restriction limiting TCP/8000 to a single engineering host
netsh advfirewall firewall add rule name="TeleControl Restrict 8000" ^
    dir=in action=allow protocol=TCP localport=8000 ^
    remoteip=10.10.20.15 profile=any
netsh advfirewall firewall add rule name="TeleControl Block 8000" ^
    dir=in action=block protocol=TCP localport=8000