CVE-2025-32833: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32833 Overview

CVE-2025-32833 is a SQL injection vulnerability in Siemens TeleControl Server Basic, affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockProjectUserRights method, which fails to properly sanitize input before constructing SQL queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and modify the application database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability impacts industrial control system (ICS) environments where TeleControl Server Basic manages remote terminal units over telecontrol protocols.

Critical Impact
Successful exploitation grants database read/write access and code execution as NT AUTHORITY\NetworkService on the host running TeleControl Server Basic.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to authenticated users
Industrial control system networks running the affected product

Discovery Timeline

2025-04-16 - CVE-2025-32833 published to the National Vulnerability Database (NVD)
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32833

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the UnlockProjectUserRights method of TeleControl Server Basic. The method constructs SQL queries using attacker-influenced input without parameterization or proper escaping. Because the method is reachable through the authenticated network interface on port 8000, any user with valid low-privilege credentials can manipulate the SQL statement executed by the backend database.

Exploitation produces three distinct outcomes. First, the attacker can bypass authorization controls enforced at the application layer by manipulating the underlying authorization query. Second, the attacker gains arbitrary read and write access to the application database. Third, depending on the database configuration, the attacker can achieve code execution under the NT AUTHORITY\NetworkService account on the host.

Root Cause

The UnlockProjectUserRights method concatenates user-controlled input directly into a SQL query string rather than using parameterized statements or prepared queries. This is a well-known anti-pattern that allows injected SQL syntax to alter query semantics.

Attack Vector

The attack vector is network-based and requires authentication. The attacker must reach TCP port 8000 on the target host and possess valid credentials to invoke the vulnerable method. Once authenticated, the attacker submits crafted input that the application passes into the injectable SQL query. No user interaction is required.

No public proof-of-concept exploit code has been published. Refer to the Siemens Security Advisory SSA-443402 for vendor-confirmed technical details.

Detection Methods for CVE-2025-32833

Indicators of Compromise

Unexpected database connections or queries originating from the TeleControl Server Basic process referencing UnlockProjectUserRights
New or modified rows in the application database that were not introduced through legitimate workflows
Outbound network connections or process executions spawned by the NT AUTHORITY\NetworkService account on the TeleControl host
Authentication events to port 8000 from unexpected source addresses or at unusual times

Detection Strategies

Inspect application and database logs for SQL syntax characters or boolean payloads in parameters submitted to the UnlockProjectUserRights endpoint
Correlate authenticated session activity on port 8000 with database query anomalies and unexpected child processes of the TeleControl service
Monitor for privilege transitions or process creations performed by NT AUTHORITY\NetworkService that fall outside known operational baselines

Monitoring Recommendations

Enable verbose audit logging on the database backing TeleControl Server Basic and forward logs to a central SIEM or data lake
Capture full network flow data for traffic to port 8000 and alert on connections from unauthorized network segments
Track configuration and schema changes to the TeleControl database and alert on unexpected DDL or DML statements

How to Mitigate CVE-2025-32833

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later
Restrict access to TCP port 8000 to trusted management hosts using host-based and network firewalls
Rotate credentials for all TeleControl Server Basic user accounts following the upgrade
Review database contents for evidence of unauthorized modification prior to patching

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates CVE-2025-32833. Apply the update following the upgrade procedure documented in the Siemens Security Advisory SSA-443402. After patching, verify the installed version and confirm that no legacy instances remain reachable on the network.

Workarounds

Place TeleControl Server Basic behind a segmented OT or management network with strict ingress filtering on port 8000
Limit authenticated user accounts to the minimum required and remove unused or shared credentials
Apply the principle of least privilege to the NT AUTHORITY\NetworkService account where supported, including restricting outbound network access from the host

bash

# Configuration example: restrict access to TCP port 8000 to a trusted management subnet on Windows
netsh advfirewall firewall add rule name="TeleControl 8000 Allow Mgmt" dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.0/24
netsh advfirewall firewall add rule name="TeleControl 8000 Block Other" dir=in action=block protocol=TCP localport=8000