CVE-2025-32842: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32842 Overview

CVE-2025-32842 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used GetUsers method and allows authenticated remote attackers to inject malicious SQL queries. Successful exploitation lets attackers bypass authorization controls, read and modify the application database, and execute code under the NT AUTHORITY\NetworkService account. Exploitation requires network access to TCP port 8000 on a host running the vulnerable application. The weakness is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute code as NT AUTHORITY\NetworkService and fully compromise the TeleControl database used in industrial control environments.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Industrial control system (ICS) deployments exposing TCP port 8000
SCADA environments using TeleControl Server Basic for remote site management

Discovery Timeline

2025-04-16 - CVE-2025-32842 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32842

Vulnerability Analysis

The vulnerability resides in the GetUsers method internally used by TeleControl Server Basic. The method concatenates user-supplied input into SQL statements without proper parameterization or sanitization. Authenticated clients connecting to TCP port 8000 can craft input that breaks out of the intended query context.

Exploitation grants three escalating outcomes. First, attackers bypass the application's authorization controls because the injected SQL runs with the privileges of the backend service account. Second, they gain arbitrary read and write access to the database. Third, the database service supports query constructs that allow command execution on the host with NT AUTHORITY\NetworkService permissions.

The attack vector is the network, attack complexity is low, and only low privileges are required. No user interaction is needed. The EPSS score is 0.604% with a percentile of 44.221.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The GetUsers method builds queries through string concatenation rather than using parameterized statements or prepared queries.

Attack Vector

An authenticated attacker with network access to port 8000 invokes the GetUsers method with crafted parameters containing SQL metacharacters. The injected payload alters the executed query, returning unauthorized data or triggering stored procedures that pivot to operating system command execution. See the Siemens Security Advisory SSA-443402 for vendor-confirmed technical details.

Detection Methods for CVE-2025-32842

Indicators of Compromise

Unexpected authenticated sessions to TCP port 8000 on TeleControl Server Basic hosts from non-administrative endpoints
Process creation events where NT AUTHORITY\NetworkService spawns cmd.exe, powershell.exe, or other shell utilities
New or modified rows in the TeleControl user tables not correlating with legitimate administrative activity
Database error log entries containing malformed GetUsers parameters or SQL syntax errors

Detection Strategies

Monitor SQL Server logs for syntax errors and unusual query patterns originating from the TeleControl Server Basic service account
Inspect network traffic to port 8000 for non-standard payloads and unauthorized client source addresses
Alert on child processes of the TeleControl service binary, particularly script interpreters and reconnaissance utilities

Monitoring Recommendations

Enable SQL Server auditing for the TeleControl database and forward logs to a centralized SIEM for correlation
Baseline normal NT AUTHORITY\NetworkService behavior and alert on deviations such as outbound network connections or file system writes outside expected directories
Track authentication events on the TeleControl application and flag accounts performing repeated GetUsers calls

How to Mitigate CVE-2025-32842

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later as published in Siemens advisory SSA-443402
Restrict network access to TCP port 8000 using host-based and perimeter firewalls, permitting only authorized engineering workstations
Rotate credentials for all TeleControl application accounts after patching, assuming prior compromise where exposure existed
Review database contents and user tables for unauthorized modifications introduced before remediation

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address this vulnerability. Refer to the Siemens Security Advisory SSA-443402 for download links and verification details. Apply the patch following Siemens' documented upgrade procedures and validate functionality in a staging environment first.

Workarounds

Block external access to TCP port 8000 at the network perimeter and segment the TeleControl server within an isolated ICS network zone
Limit application accounts to the minimum necessary users and enforce strong authentication to reduce the pool of potential attackers
Run the TeleControl service with the least privilege necessary and restrict the NT AUTHORITY\NetworkService account's ability to spawn shells or access sensitive resources

bash

# Configuration example: Windows firewall rule restricting port 8000 to authorized hosts
New-NetFirewallRule -DisplayName "TeleControl-Port8000-Restrict" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "TeleControl-Port8000-BlockAll" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -Action Block