CVE-2025-32844: Siemens Telecontrol Server Basic SQLi

CVE-2025-32844 Overview

CVE-2025-32844 is a SQL injection vulnerability in Siemens TeleControl Server Basic, affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockUser method, which fails to sanitize input before constructing SQL queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read from and write to the application database, and execute code with NT AUTHORITY\NetworkService privileges. Siemens addressed the issue in version V3.1.2.2 and published advisory SSA-443402.

Critical Impact
Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService on systems running vulnerable TeleControl Server Basic instances exposing port 8000.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to attacker-reachable networks
Industrial control environments using TeleControl Server Basic for SCADA telecontrol

Discovery Timeline

2025-04-16 - CVE-2025-32844 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32844

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the UnlockUser method of TeleControl Server Basic. The method accepts attacker-controlled parameters and concatenates them into a SQL statement without parameterization or input validation. Because UnlockUser is invoked through the application's network interface on port 8000, an authenticated client can submit crafted payloads that alter query semantics.

Exploitation enables arbitrary database reads and writes. Because the database backend supports execution primitives accessible to the application service account, attackers can pivot from injection to operating system command execution. The resulting code runs in the security context of NT AUTHORITY\NetworkService, granting access to host resources, configuration files, and additional network services.

Root Cause

The root cause is the use of dynamically constructed SQL queries inside the UnlockUser routine. Input parameters are interpolated directly into the SQL statement instead of being passed through prepared statements or parameterized APIs. The function also lacks authorization checks proportionate to its privileged behavior, allowing low-privileged authenticated users to reach a sensitive code path.

Attack Vector

The attack vector is network-based. An attacker authenticates to the application and sends a crafted request to the UnlockUser endpoint over TCP port 8000. The injected SQL payload bypasses authorization logic and is executed by the database engine with the application's privileges. From this position, the attacker can extract credentials, modify telecontrol configuration data, or invoke stored procedures that yield command execution as NT AUTHORITY\NetworkService.

No public proof-of-concept exploit has been published for this CVE, and CISA has not added it to the Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-32844

Indicators of Compromise

Unexpected inbound connections to TCP port 8000 on TeleControl Server Basic hosts from non-administrative sources
Anomalous child processes spawned by the TeleControl service running under NT AUTHORITY\NetworkService
Database log entries showing malformed SQL syntax, UNION, ;--, or stacked queries originating from the UnlockUser workflow
Unexpected modifications to user account or authorization tables within the TeleControl database

Detection Strategies

Enable SQL Server auditing on the TeleControl backend database and alert on syntax errors or rare query patterns tied to UnlockUser
Inspect application logs for UnlockUser calls containing SQL metacharacters such as single quotes, semicolons, or comment tokens
Apply network IDS signatures for SQL injection payloads targeting TCP port 8000 on TeleControl hosts
Baseline process lineage for the TeleControl service and flag executions of cmd.exe, powershell.exe, or scripting hosts as children

Monitoring Recommendations

Restrict and continuously monitor authenticated user sessions against the TeleControl server, particularly accounts with low privilege that access administrative endpoints
Forward TeleControl, Windows Security, and SQL Server logs to a centralized SIEM for correlation across application, host, and database layers
Track outbound connections from the TeleControl host that could indicate post-exploitation command-and-control activity

How to Mitigate CVE-2025-32844

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published in Siemens advisory SSA-443402
Restrict TCP port 8000 access to trusted engineering workstations using host and network firewalls
Rotate credentials for any accounts that have authenticated to vulnerable TeleControl instances
Review the TeleControl database and user tables for unauthorized modifications

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UnlockUser method. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402. Operators should plan downtime to apply the update on all affected installations.

Workarounds

Limit access to TCP port 8000 to a small allowlist of management hosts at the firewall layer
Place TeleControl Server Basic inside a segmented operational technology network protected by an industrial DMZ
Disable or restrict low-privileged authenticated accounts that are not required for daily operations
Run the TeleControl service under a least-privilege account if local policy permits, reducing the impact of code execution

bash

# Example: restrict TCP 8000 to a single engineering workstation on Windows
netsh advfirewall firewall add rule name="TeleControl 8000 Allow Engineering" \
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.0.10.25
netsh advfirewall firewall add rule name="TeleControl 8000 Block Other" \
  dir=in action=block protocol=TCP localport=8000