CVE-2025-32843: Siemens Telecontrol Server Basic SQLi

CVE-2025-32843 Overview

CVE-2025-32843 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used LockUser method, which fails to properly sanitize input passed to database queries. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService and gain full read/write access to the application database via SQL injection on port 8000.

Affected Products

• Siemens TeleControl Server Basic, all versions prior to V3.1.2.2
• Windows hosts running the vulnerable TeleControl Server Basic service on TCP port 8000
• Industrial control environments using TeleControl Server Basic for SCADA telecontrol communications

Discovery Timeline

• 2025-04-16 - CVE-2025-32843 published to the National Vulnerability Database
• 2025-04-16 - Siemens publishes Security Advisory SSA-443402
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32843

Vulnerability Analysis

The vulnerability is a SQL injection flaw reachable through the LockUser method exposed by the TeleControl Server Basic application. The method handles user-supplied parameters and concatenates them into an SQL statement without proper parameterization or input neutralization. Because the service runs under NT AUTHORITY\NetworkService, successful exploitation provides query execution within the database context and operating system code execution at the service account privilege level.

Exploitation requires the attacker to authenticate to the application and reach the service on TCP port 8000. Once those preconditions are met, the attacker can bypass authorization checks enforced inside the LockUser method by manipulating the query logic. This enables arbitrary read and write operations on the backing database, including stored configuration, user records, and telemetry data used by the SCADA workflow.

Root Cause

The root cause is improper neutralization of SQL syntax in input passed to the LockUser method [CWE-89]. The method constructs queries through string concatenation rather than prepared statements, allowing attacker-controlled values to alter SQL grammar. Authorization checks layered on top of the same query path can be subverted by injecting clauses that change the predicate evaluation.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker must hold valid credentials and be able to reach TCP port 8000 on the affected server. No user interaction is required. After authenticating, the attacker invokes the LockUser method with malicious payloads that extend the underlying SQL query, enabling data manipulation and command execution paths within the database engine that reach the host operating system.

The vulnerability mechanism is described in the Siemens Security Advisory SSA-443402. No public proof-of-concept code is currently available.

Detection Methods for CVE-2025-32843

Indicators of Compromise

• Unexpected authenticated sessions to TCP port 8000 on TeleControl Server Basic hosts, particularly from non-engineering workstations
• Anomalous database queries originating from the TeleControl Server Basic service that include SQL meta-characters or stacked statements
• New child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
• Modifications to user lock state or authorization tables that do not correspond to legitimate administrative activity

Detection Strategies

• Monitor application and database logs for invocations of the LockUser method that contain SQL syntax such as single quotes, semicolons, or UNION keywords
• Alert on process creation events where NT AUTHORITY\NetworkService spawns interpreters such as cmd.exe, powershell.exe, or sqlcmd.exe
• Use network detection rules on traffic destined for port 8000 to identify malformed or oversized authentication payloads

Monitoring Recommendations

• Enable verbose audit logging on the TeleControl Server Basic database instance and forward events to a centralized SIEM
• Track failed and successful authentications to the application service and correlate with downstream database query anomalies
• Baseline normal NetworkService process behavior on TeleControl hosts and alert on deviations

How to Mitigate CVE-2025-32843

Immediate Actions Required

• Upgrade TeleControl Server Basic to version V3.1.2.2 or later as specified in Siemens advisory SSA-443402
• Restrict network access to TCP port 8000 so that only trusted engineering workstations and management hosts can reach the service
• Rotate credentials for all TeleControl Server Basic accounts after patching, assuming prior exposure
• Review database and operating system logs for evidence of prior exploitation against the LockUser method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address CVE-2025-32843. Refer to Siemens Security Advisory SSA-443402 for download instructions and full remediation guidance. Apply the update on all affected installations as the primary mitigation.

Workarounds

• Block external access to TCP port 8000 at the perimeter firewall and limit internal access through network segmentation
• Place TeleControl Server Basic systems inside an isolated operational technology network protected by a demilitarized zone
• Enforce least privilege on application accounts and remove unused or stale users that could be leveraged for authenticated access

# Example Windows firewall rule restricting port 8000 to a trusted management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000