CVE-2025-32841: Siemens Telecontrol Server Basic SQLI

CVE-2025-32841 Overview

CVE-2025-32841 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockGateway method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and modify data in the application database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is tracked under CWE-89 and documented in Siemens Security Advisory SSA-443402.

Critical Impact
Authenticated attackers reachable on port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and gain full control over the TeleControl database backing industrial telecontrol operations.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 on the management host
Windows hosts running the TeleControl service under NT AUTHORITY\NetworkService

Discovery Timeline

2025-04-16 - CVE-2025-32841 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32841

Vulnerability Analysis

TeleControl Server Basic exposes an internal UnlockGateway method over its management interface on TCP port 8000. The method incorporates attacker-controlled input directly into a SQL statement without parameterization or escaping. An authenticated client can submit crafted payloads that break out of the intended query structure and append arbitrary SQL.

Because the database account used by the application has high privileges on the host, successful injection extends beyond data tampering. The advisory states that exploitation yields code execution with NT AUTHORITY\NetworkService privileges, indicating the attacker can reach operating system primitives such as xp_cmdshell or equivalent stored procedures from the SQL context. The EPSS score for this issue is 0.604%.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The UnlockGateway handler builds queries through string concatenation instead of prepared statements with bound parameters. Authorization checks are also enforced at a layer above the database, so injected SQL bypasses application-level access controls entirely.

Attack Vector

Exploitation requires network access to port 8000 on the TeleControl Server Basic host and valid authentication to the application. The attacker sends a request that invokes the internal UnlockGateway flow with a malicious payload in a parameter consumed by the vulnerable query. Once the injected SQL executes, the attacker can pivot to operating system command execution through the database engine, escalating from low-privileged application user to host-level code execution as NT AUTHORITY\NetworkService.

No public proof-of-concept exploit is currently listed for CVE-2025-32841, and the vulnerability is not on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-32841

Indicators of Compromise

Unexpected outbound connections or process launches originating from the TeleControl Server Basic service account NT AUTHORITY\NetworkService.
SQL Server logs containing syntactically unusual statements referencing the UnlockGateway workflow, especially with stacked queries or comment sequences.
New or modified rows in TeleControl administrative tables that do not correlate with legitimate operator activity.
Authentication events to port 8000 from hosts outside the documented engineering workstation inventory.

Detection Strategies

Enable verbose application and SQL query auditing on the TeleControl database and alert on UnlockGateway invocations containing characters such as ', ;, --, or /*.
Baseline child processes of the TeleControl service and flag spawns of cmd.exe, powershell.exe, or scripting hosts as NetworkService.
Correlate authentication logs on port 8000 with subsequent database write activity to identify abuse of low-privileged accounts.

Monitoring Recommendations

Restrict and log all network traffic to TCP port 8000 at the perimeter firewall and at host-based firewalls on the TeleControl server.
Forward Windows Security, Sysmon, and SQL Server audit logs to a centralized analytics platform for cross-source correlation.
Review the Siemens Security Advisory SSA-443402 periodically for updated indicators and patch guidance.

How to Mitigate CVE-2025-32841

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published by Siemens.
Block external access to TCP port 8000 and limit it to a small set of trusted engineering workstations.
Rotate credentials for all TeleControl application accounts, particularly any low-privileged users that could be leveraged for authenticated exploitation.
Review database audit logs for prior signs of UnlockGateway abuse before applying the patch.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate CVE-2025-32841. Operators should obtain the update through standard Siemens distribution channels and follow installation guidance in Siemens Security Advisory SSA-443402. Verify the running version after upgrade and confirm service restoration before re-enabling external connectivity.

Workarounds

Place the TeleControl server inside a segmented operational technology network and enforce strict firewall rules limiting port 8000 to authorized hosts.
Apply Siemens' general operational guidelines for Industrial Security and the recommendations in advisory SSA-443402 where immediate patching is not feasible.
Disable or restrict any unused TeleControl application accounts to reduce the pool of credentials usable for authenticated exploitation.

bash

# Configuration example: restrict access to TeleControl management port on Windows
netsh advfirewall firewall add rule name="Block TeleControl 8000 Inbound" \
  dir=in action=block protocol=TCP localport=8000

netsh advfirewall firewall add rule name="Allow TeleControl 8000 from Engineering" \
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.0/24