CVE-2025-32830: Siemens Telecontrol Server Basic SQLi

CVE-2025-32830 Overview

CVE-2025-32830 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used UnlockProject method, which fails to properly sanitize input passed to database queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability carries a CVSS 4.0 score of 8.7 and impacts industrial control system environments where TeleControl Server Basic aggregates telemetry from remote terminal units.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and manipulate the underlying database used for SCADA telecontrol operations.

Affected Products

Siemens TeleControl Server Basic - all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial environments using TeleControl Server Basic for SINAUT ST7 communications

Discovery Timeline

2025-04-16 - CVE-2025-32830 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32830

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the UnlockProject method exposed by TeleControl Server Basic. The method accepts attacker-controlled input and concatenates it into a SQL statement without proper parameterization or input validation. This allows query logic manipulation, including authorization bypass, arbitrary read and write operations against the application database, and ultimately command execution through the underlying database engine.

Exploitation requires only low-privilege authenticated access to the application combined with network reachability to port 8000. Because the application service runs as NT AUTHORITY\NetworkService, successful exploitation grants execution under that Windows service account, which retains network credentials of the host and can interact with other services on the local system.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The UnlockProject handler builds SQL strings dynamically using untrusted parameters supplied by the client, without using prepared statements or stored procedures with bound parameters. The handler also lacks server-side authorization checks proportional to its database privileges.

Attack Vector

The attacker must hold valid application credentials and must be able to reach port 8000 on the server hosting TeleControl Server Basic. The attacker invokes the UnlockProject method with a crafted payload that escapes the intended SQL context. Once the injection succeeds, the attacker can issue arbitrary queries, enable database-level command execution primitives such as xp_cmdshell, and pivot to operating system code execution as NT AUTHORITY\NetworkService. No verified public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32830

Indicators of Compromise

Unexpected authenticated sessions to TeleControl Server Basic over TCP port 8000 from non-engineering workstations
Child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService
Database log entries showing unusual queries originating from the UnlockProject code path, including stacked statements or use of xp_cmdshell
Modifications to project tables or user authorization records without corresponding operator activity

Detection Strategies

Monitor application and database logs for malformed or syntactically suspicious parameters passed to the UnlockProject method
Alert on any execution of cmd.exe, powershell.exe, or scripting hosts spawned as a child of the TeleControl Server Basic process
Correlate failed authentication attempts followed by successful authentications from the same source IP on port 8000
Inspect outbound network connections originating from the NetworkService context for signs of command-and-control traffic

Monitoring Recommendations

Enable SQL Server auditing to capture all statements executed by the TeleControl Server Basic service account
Forward TeleControl Server Basic application logs and Windows Security event logs to a centralized SIEM
Baseline normal port 8000 client populations and alert on new or anomalous sources
Track service account behavior for deviations from documented operational patterns

How to Mitigate CVE-2025-32830

Immediate Actions Required

Update Siemens TeleControl Server Basic to V3.1.2.2 or later as published in Siemens Security Advisory SSA-443402
Restrict network access to TCP port 8000 to trusted engineering workstations using host-based and network firewalls
Rotate credentials for all TeleControl Server Basic application accounts after patching
Review database audit logs for evidence of prior exploitation against the UnlockProject method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address CVE-2025-32830. Apply the update on all systems running prior versions. Detailed remediation guidance and download links are available in the Siemens Security Advisory SSA-443402.

Workarounds

Place the TeleControl Server Basic host inside a segmented operational technology (OT) network protected by a firewall that allows port 8000 only from defined source addresses
Disable or remove TeleControl Server Basic user accounts that are not actively required, reducing the population of credentials usable for authenticated exploitation
Follow Siemens operational guidelines for securing industrial control system environments, including defense-in-depth and cell protection concepts

bash

# Example: restrict inbound access to TeleControl Server Basic port 8000 on Windows
netsh advfirewall firewall add rule name="TCSB-Port8000-Allowlist" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24 profile=any

netsh advfirewall firewall add rule name="TCSB-Port8000-Deny" ^
  dir=in action=block protocol=TCP localport=8000 profile=any