CVE-2025-32835: Siemens Telecontrol Server Basic SQLi

CVE-2025-32835 Overview

CVE-2025-32835 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateConnectionVariableArchivingBuffering method. An authenticated remote attacker with network access to port 8000 can bypass authorization controls, read and write to the application's database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is categorized under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Successful exploitation allows authenticated attackers to execute arbitrary code on the host system with NetworkService privileges and gain full read/write access to the backend database.

Affected Products

Siemens TeleControl Server Basic (all versions prior to V3.1.2.2)
Industrial Control System (ICS) environments using TeleControl Server Basic for SCADA communications
Systems exposing TCP port 8000 of the TeleControl Server application

Discovery Timeline

2025-04-16 - CVE-2025-32835 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32835

Vulnerability Analysis

The vulnerability exists in the UpdateConnectionVariableArchivingBuffering method exposed by the TeleControl Server Basic service. Input parameters passed to this method are concatenated into SQL statements without proper sanitization or parameterization. An authenticated attacker who can reach port 8000 on the host can inject arbitrary SQL syntax through this method.

Because the application service runs under the NT AUTHORITY\NetworkService Windows account, successful SQL injection can be escalated beyond data access. Attackers can leverage database-level command execution primitives such as xp_cmdshell or stored procedure abuse to run operating system commands with NetworkService privileges, providing a foothold for further lateral movement within OT networks.

Root Cause

The root cause is improper neutralization of attacker-controlled input within the UpdateConnectionVariableArchivingBuffering method. The method constructs SQL queries through string concatenation instead of using parameterized statements or prepared queries. Authorization checks on this internal method are also insufficient, allowing low-privileged authenticated users to invoke functionality reserved for higher-trust operations.

Attack Vector

Exploitation requires network access to TCP port 8000 on the target host and valid authentication credentials. The attacker authenticates to the TeleControl Server, invokes the vulnerable internal method with a malicious payload, and the server executes the resulting SQL against the backend database. Because TeleControl Server Basic is typically deployed in industrial environments connecting RTUs and SCADA systems, exposure of port 8000 to untrusted networks significantly increases risk.

No verified public proof-of-concept code is available. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32835

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
Anomalous SQL queries in database logs referencing UpdateConnectionVariableArchivingBuffering with concatenated metacharacters such as single quotes, semicolons, or UNION SELECT patterns
Outbound network connections from the TeleControl Server host to attacker-controlled infrastructure
New or modified database stored procedures, tables, or user accounts that do not match change-management records

Detection Strategies

Monitor authentication logs for the TeleControl Server service for repeated logins followed by anomalous method invocations on port 8000
Deploy database activity monitoring to alert on SQL syntax patterns indicative of injection within calls to the affected method
Inspect Windows event logs for command execution chains originating from the TeleControl Server process tree
Correlate network flow data to identify unexpected inbound traffic to port 8000 from non-engineering workstation subnets

Monitoring Recommendations

Enable SQL Server auditing on the TeleControl Server database with focus on procedure calls and xp_cmdshell usage
Forward TeleControl Server and Windows host telemetry to a centralized SIEM for correlation across OT and IT events
Baseline normal process behavior of the TeleControl Server service and alert on deviations such as new shells or scripting interpreters

How to Mitigate CVE-2025-32835

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens advisory SSA-443402
Restrict network access to TCP port 8000 so that only authorized engineering workstations and management servers can reach the service
Audit and rotate credentials for all accounts authorized to authenticate to the TeleControl Server
Review database logs and host event logs for prior exploitation attempts against the UpdateConnectionVariableArchivingBuffering method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address this vulnerability. Apply the update on all affected installations. Full remediation details are documented in the Siemens Security Advisory SSA-443402.

Workarounds

Place the TeleControl Server host behind an industrial firewall and permit port 8000 access only from a defined allowlist of source addresses
Segment the OT network from corporate IT networks following IEC 62443 zone and conduit guidance
Disable or restrict the NetworkService account's ability to launch command interpreters by applying Windows least-privilege controls
Where the application supports it, reduce the privileges of the database account used by TeleControl Server so it cannot invoke xp_cmdshell or modify schema objects

bash

# Example Windows Firewall rule restricting access to TeleControl Server port 8000
netsh advfirewall firewall add rule ^
  name="Restrict TeleControl Server 8000" ^
  dir=in ^
  action=allow ^
  protocol=TCP ^
  localport=8000 ^
  remoteip=10.10.20.0/24 ^
  profile=any

netsh advfirewall firewall add rule ^
  name="Block TeleControl Server 8000 default" ^
  dir=in ^
  action=block ^
  protocol=TCP ^
  localport=8000