CVE-2025-32832: Siemens Telecontrol Server Basic SQLi

CVE-2025-32832 Overview

CVE-2025-32832 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used LockProjectUserRights method, which fails to properly sanitize input before constructing SQL queries. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is tracked under CWE-89 and documented in Siemens Security Advisory SSA-443402.

Critical Impact
Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService and gain full read/write access to the application database on industrial control systems.

Affected Products

Siemens TeleControl Server Basic – all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to attacker-reachable networks
Industrial environments relying on TeleControl Server Basic for SCADA telecontrol communications

Discovery Timeline

2025-04-16 - CVE-2025-32832 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32832

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the LockProjectUserRights method used internally by TeleControl Server Basic. The application constructs database queries by concatenating attacker-controlled input rather than using parameterized statements. Because the affected method handles project user rights, it sits inside the authorization layer and processes input before access checks complete.

Exploitation requires authentication and network access to TCP port 8000, where the application exposes its service interface. Once an attacker injects crafted SQL, the database engine executes the injected statements with the privileges of the application's service account. This allows the attacker to bypass authorization logic, manipulate stored records, and pivot to command execution through stacked queries or stored procedures available to the NetworkService account.

The combined impact on confidentiality, integrity, and availability stems from full database read/write access and code execution at the operating system level under NT AUTHORITY\NetworkService. EPSS estimates exploitation probability at 0.604% with a percentile of 44.214.

Root Cause

The LockProjectUserRights method concatenates untrusted input into SQL statements without parameterization or input validation. The authorization check that should restrict this method is itself bypassable through the injection, since SQL execution occurs before rights enforcement completes.

Attack Vector

An authenticated attacker sends a crafted request to TCP port 8000 targeting the LockProjectUserRights code path. The injected SQL payload executes within the application's database session, granting database manipulation and operating system command execution through database engine features available to the service account.

No verified public proof-of-concept is currently available. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32832

Indicators of Compromise

Unexpected authenticated sessions to TCP port 8000 on TeleControl Server Basic hosts originating from untrusted subnets
Database log entries containing SQL syntax fragments such as UNION SELECT, xp_cmdshell, or stacked semicolons issued through the application service account
Child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService
Modifications to project user rights tables that do not correspond to administrator activity

Detection Strategies

Inspect application and database logs for malformed parameters reaching the LockProjectUserRights method
Alert on any process creation event where the TeleControl Server Basic service is the parent and the child is a shell, scripting host, or LOLBin
Correlate authentication events on port 8000 with subsequent database write operations on rights or project tables

Monitoring Recommendations

Enable verbose SQL query auditing on the database backing TeleControl Server Basic and retain logs for forensic review
Monitor outbound network connections from the TeleControl host, since attacker code executes with network-capable service privileges
Baseline normal traffic to TCP port 8000 and alert on volume spikes or new source addresses

How to Mitigate CVE-2025-32832

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published in Siemens Security Advisory SSA-443402
Restrict TCP port 8000 to a dedicated management VLAN reachable only by authorized engineering workstations
Rotate credentials for all TeleControl Server Basic user accounts after patching to invalidate any stolen authentication material
Review database contents and project user rights tables for unauthorized modifications

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the LockProjectUserRights method. Operators should obtain the update through Siemens Industry Online Support and follow the upgrade procedure documented in advisory SSA-443402. No partial or hotfix patches are referenced in the vendor advisory.

Workarounds

Apply network segmentation so that only trusted hosts can reach TCP port 8000 on the TeleControl server
Place the TeleControl host behind a firewall that enforces source IP allowlisting for the management service
Disable or remove unused TeleControl Server Basic accounts to reduce the authenticated attack surface
Follow Siemens operational guidelines for industrial security and the IEC 62443 defense-in-depth recommendations

bash

# Example Windows firewall rule restricting port 8000 to a trusted management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block-Other" ^
  dir=in action=block protocol=TCP localport=8000