CVE-2025-32838: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32838 Overview

CVE-2025-32838 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used ImportConnectionVariables method. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService and gain full read/write access to the application database on affected industrial control systems.

Affected Products

Siemens TeleControl Server Basic — All versions prior to V3.1.2.2
Component: siemens:telecontrol_server_basic
Vendor: Siemens

Discovery Timeline

2025-04-16 - CVE-2025-32838 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32838

Vulnerability Analysis

The vulnerability is a SQL injection flaw in the ImportConnectionVariables method of Siemens TeleControl Server Basic. The method is used internally by the application but is reachable by authenticated remote attackers that can connect to port 8000. The flaw allows attackers to inject arbitrary SQL statements into queries processed by the application's database backend.

Successful exploitation grants three distinct outcomes. First, the attacker bypasses authorization controls enforced at the application layer. Second, the attacker gains arbitrary read and write access to the application database. Third, the attacker can execute code in the context of the NT AUTHORITY\NetworkService account on the host operating system.

The vulnerability requires authentication, which limits exposure to attackers who already hold valid credentials or who have compromised an authorized account. The EPSS score is 0.604% with a percentile of 44.397.

Root Cause

The ImportConnectionVariables method fails to properly neutralize user-supplied input before incorporating it into SQL statements. This violates secure query construction practices, such as parameterized queries or prepared statements, that prevent attacker-controlled data from altering query structure.

Attack Vector

The attack is delivered over the network to TCP port 8000 on a host running a vulnerable version of TeleControl Server Basic. The attacker must hold valid application credentials. Once authenticated, the attacker invokes the vulnerable internal method with crafted input that triggers SQL injection, leading to database compromise and code execution as NT AUTHORITY\NetworkService.

No verified public proof-of-concept exploit code is available. Refer to the Siemens Security Advisory #SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32838

Indicators of Compromise

Unexpected processes spawned by the TeleControl Server Basic service running under the NT AUTHORITY\NetworkService account.
Anomalous SQL queries in database logs containing injection patterns such as stacked queries, UNION SELECT, or xp_cmdshell invocations originating from the application service account.
Unauthorized modifications to TeleControl Server Basic database tables, including changes to user, role, or configuration records.

Detection Strategies

Inspect network traffic to TCP port 8000 on TeleControl Server Basic hosts for requests that target the ImportConnectionVariables method with malformed or oversized payloads.
Enable SQL Server auditing on the TeleControl database and alert on syntax errors, failed query patterns, and use of system stored procedures by the application account.
Correlate authentication events with downstream database write activity to identify post-authentication abuse from a single session.

Monitoring Recommendations

Forward Windows process creation events (Event ID 4688) from the TeleControl host to a central log platform and alert on child processes of the application service.
Monitor for outbound connections originating from the NetworkService context that deviate from the application baseline.
Track failed and successful authentication attempts to TeleControl Server Basic and flag accounts with abnormal usage patterns.

How to Mitigate CVE-2025-32838

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later on all affected hosts.
Restrict network access to TCP port 8000 using host-based firewalls and network segmentation, allowing only trusted engineering workstations.
Audit and rotate credentials for all TeleControl Server Basic accounts, removing unused or shared accounts.
Review database logs and application activity for indicators of prior exploitation.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates this vulnerability. Apply the update following the guidance in Siemens Security Advisory #SSA-443402. The advisory is the authoritative source for fixed versions, mitigations, and operational guidance from the vendor.

Workarounds

Block TCP port 8000 at the perimeter and on internal firewalls where the service is not required for operations.
Place TeleControl Server Basic hosts inside an isolated ICS network zone protected by a demilitarized zone, consistent with IEC 62443 segmentation guidance.
Enforce least-privilege access for the application service account and consider running the service under a constrained account where supported by the deployment.
Limit application logins to a small set of named engineering accounts and disable remote access for service or generic accounts.

bash

# Example Windows Firewall rule restricting access to port 8000
New-NetFirewallRule -DisplayName "Restrict TeleControl 8000" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "Block TeleControl 8000 Default" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -Action Block