CVE-2025-32829: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32829 Overview

CVE-2025-32829 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used LockProjectCrossCommunications method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and write to the application database, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService, compromising telecontrol operations and downstream industrial systems.

Affected Products

Siemens TeleControl Server Basic, all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial environments using TeleControl Server Basic for SCADA aggregation

Discovery Timeline

2025-04-16 - CVE-2025-32829 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32829

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the LockProjectCrossCommunications method exposed by the TeleControl Server Basic application. The method is invoked internally as part of project locking operations but is reachable by authenticated remote clients that connect to the application service on TCP port 8000. Because user-supplied parameters are concatenated into SQL statements without parameterization or input validation, an attacker can inject arbitrary SQL syntax that the backend database engine then executes.

The consequence extends beyond data manipulation. The service runs under the NT AUTHORITY\NetworkService Windows account, and the underlying database supports stored procedures and command-execution primitives. Successful SQL injection therefore yields code execution at the privilege level of the service account, allowing an attacker to pivot from a database compromise to operating system command execution on the host.

Root Cause

The root cause is improper neutralization of special characters in SQL statements [CWE-89]. The LockProjectCrossCommunications method constructs queries through string concatenation rather than using parameterized queries or prepared statements. Authorization checks inside the method can also be bypassed because the injected SQL alters the logical flow of subsequent database operations.

Attack Vector

Exploitation requires network access to port 8000 on the target host and authenticated session credentials for the TeleControl Server Basic application. Once authenticated, the attacker submits a crafted request to the vulnerable method containing SQL metacharacters and chained statements. The injected payload manipulates database queries, escalates privileges within the application, and ultimately invokes database-layer features to run operating system commands as NetworkService. No user interaction is required, and the attack complexity is low.

No verified proof-of-concept code is publicly available at the time of writing. Technical details should be reviewed in the Siemens Security Advisory SSA-443402.

Detection Methods for CVE-2025-32829

Indicators of Compromise

Inbound TCP connections to port 8000 of TeleControl Server Basic hosts from unexpected source addresses or out-of-baseline accounts.
Database audit entries showing unusual statements originating from the LockProjectCrossCommunications code path, including stacked queries or use of xp_cmdshell-style procedures.
Process creation events on the server with parent NT AUTHORITY\NetworkService spawning cmd.exe, powershell.exe, or scripting interpreters.
New or modified rows in TeleControl project tables that do not correlate with legitimate engineering activity.

Detection Strategies

Enable verbose query logging on the TeleControl Server Basic database and alert on SQL syntax patterns indicative of injection, such as comment sequences, UNION SELECT, or batched statements within parameters.
Inspect application logs for repeated failed authorization checks followed by successful operations on the same session, which can indicate authorization bypass via SQL injection.
Correlate authenticated session activity on port 8000 with subsequent process creation under the NetworkService account using endpoint telemetry.

Monitoring Recommendations

Restrict and monitor exposure of port 8000 using network flow data and segment boundary firewalls.
Forward Windows Security, Sysmon, and database audit logs from TeleControl Server Basic hosts into a centralized analytics platform for correlation.
Baseline normal LockProjectCrossCommunications call frequency and parameter shapes, then alert on deviations.

How to Mitigate CVE-2025-32829

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as published in the vendor advisory.
Restrict access to TCP port 8000 to a small set of trusted engineering workstations using host and network firewalls.
Rotate credentials for all accounts authorized to access TeleControl Server Basic, prioritizing administrator and service accounts.
Audit the TeleControl database for unauthorized schema changes, new logins, or modified stored procedures.

Patch Information

Siemens has released a fixed version of TeleControl Server Basic, V3.1.2.2, which addresses the SQL injection in the LockProjectCrossCommunications method. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

Place TeleControl Server Basic hosts behind a perimeter that blocks inbound traffic to TCP port 8000 from all sources except authorized engineering systems.
Apply the principle of least privilege to TeleControl application accounts to reduce the scope of authenticated-attacker exposure.
Enforce defense-in-depth controls recommended in Siemens Operational Guidelines for Industrial Security until patching is completed.

bash

# Example: restrict inbound access to TeleControl port 8000 on Windows
netsh advfirewall firewall add rule name="TeleControl 8000 Allow Engineering" \
    dir=in action=allow protocol=TCP localport=8000 \
    remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl 8000 Block Other" \
    dir=in action=block protocol=TCP localport=8000