CVE-2025-32824: Siemens Telecontrol Server Basic SQLi

CVE-2025-32824 Overview

CVE-2025-32824 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockProject method, which fails to properly sanitize user-supplied input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and modify database contents, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability is tracked under CWE-89 and impacts industrial telecontrol environments where the server orchestrates remote terminal units and SCADA assets.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService on affected TeleControl Server Basic systems through SQL injection in the UnlockProject method.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to reachable networks
Industrial control environments using TeleControl Server Basic for remote site management

Discovery Timeline

2025-04-16 - CVE-2025-32824 published to NVD
2025-04-16 - Siemens publishes Security Advisory SSA-443402
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32824

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in an SQL command within the UnlockProject method of TeleControl Server Basic. The method accepts attacker-controlled input and concatenates it directly into a backend SQL statement without parameterization or input validation. Because the application processes requests on TCP port 8000 with elevated service privileges, successful injection escalates beyond data tampering into command execution on the host operating system. The attacker gains the ability to read sensitive project data, modify telecontrol configurations, and stage further attacks against connected industrial endpoints.

Root Cause

The root cause is unsafe construction of SQL queries inside the UnlockProject server-side method. Input passed by an authenticated client is interpolated into the query string rather than bound through prepared statements. This allows SQL metacharacters and stacked queries to alter the intended logic. Because the underlying database engine permits OS-level command execution under the service account, injection translates directly into code execution with NT AUTHORITY\NetworkService permissions.

Attack Vector

Exploitation requires network access to TCP port 8000 on a host running a vulnerable TeleControl Server Basic version, plus valid application credentials. An attacker authenticates, invokes the UnlockProject method with a crafted payload containing SQL syntax, and the server executes the injected statements against the project database. The attacker can then read or write arbitrary tables, modify authorization records to bypass access controls, or invoke extended stored procedures to run operating system commands as the service account.

No public proof-of-concept code is available. Refer to the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-32824

Indicators of Compromise

Unexpected authenticated sessions to TCP port 8000 on TeleControl Server Basic hosts, particularly from sources outside the operations network
Database log entries showing malformed or syntactically unusual queries originating from the UnlockProject code path
Process creation events on the server where child processes spawn under the NT AUTHORITY\NetworkService account from the database engine
Modifications to project tables or authorization records that do not correspond to legitimate operator actions

Detection Strategies

Monitor authentication and method invocation logs on TeleControl Server Basic for anomalous calls to UnlockProject from low-privilege users
Inspect SQL Server audit logs for syntax errors, stacked statements, or use of xp_cmdshell originating from the application service account
Correlate network flows to port 8000 with subsequent process execution and outbound connections from the server host

Monitoring Recommendations

Enable Windows process auditing on TeleControl hosts to capture child processes of the database engine running as NetworkService
Forward application, database, and Windows Security logs to a centralized SIEM for correlation and retention
Apply network segmentation alerts when traffic to port 8000 originates outside the engineering or control network

How to Mitigate CVE-2025-32824

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later, as directed by Siemens Security Advisory SSA-443402
Restrict network access to TCP port 8000 so that only authorized engineering workstations can connect to the server
Audit application accounts and revoke credentials for inactive or unnecessary users to reduce the authenticated attack surface
Review database and Windows event logs for evidence of prior exploitation involving UnlockProject activity

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate this vulnerability. Patch details and download links are available through the Siemens Security Advisory SSA-443402. Operators of industrial environments should follow Siemens guidance on ICS patching, including validation in test environments before production rollout.

Workarounds

Block TCP port 8000 at perimeter and internal firewalls except for explicitly trusted hosts that require management access
Apply Siemens operational guidelines for industrial security, including the defense-in-depth concept and isolation of control networks from business networks
Run TeleControl Server Basic on dedicated hosts hardened to least privilege, with no additional network-exposed services
Disable or restrict database features such as xp_cmdshell on the backend SQL Server instance to limit post-injection code execution