CVE-2025-32846: Siemens Telecontrol Server Basic SQLi

CVE-2025-32846 Overview

CVE-2025-32846 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used LockGeneralSettings method, which fails to properly sanitize input passed to database queries. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. The weakness is tracked under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and fully compromise the TeleControl database.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial environments using TeleControl Server Basic for SCADA/RTU communications

Discovery Timeline

2025-04-16 - CVE-2025-32846 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32846

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input within the LockGeneralSettings method used internally by TeleControl Server Basic. The method constructs SQL queries by concatenating attacker-controlled values rather than using parameterized statements. This allows an authenticated remote attacker to alter the structure of database queries executed by the application.

Because the application service runs as NT AUTHORITY\NetworkService, successful SQL injection extends beyond data exposure. Attackers can leverage database-layer primitives such as xp_cmdshell or stored procedures to execute operating system commands in the context of the service account. This converts a data-layer flaw into an authenticated remote code execution path on the host running the TeleControl server.

The attack surface is reachable over the network on TCP port 8000, the proprietary management channel used by TeleControl Server Basic. Authorization controls inside the application are bypassed because the injected SQL executes before access checks complete.

Root Cause

The LockGeneralSettings method concatenates untrusted input directly into SQL statements without parameterization or input validation. This violates the secure coding practice of separating code from data in database interactions, classified as [CWE-89].

Attack Vector

Exploitation requires network reachability to port 8000 and valid authentication to the application. Once authenticated, the attacker submits a crafted request that invokes the vulnerable method. The malicious SQL payload runs against the backing database, granting read/write access and a path to OS command execution as NetworkService.

No verified public proof-of-concept exploit is currently available. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32846

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
Database log entries showing malformed or unusually long input to the LockGeneralSettings operation
New or modified rows in TeleControl configuration tables outside change windows
Outbound network connections initiated from the TeleControl host to unknown destinations

Detection Strategies

Monitor authenticated sessions on TCP port 8000 for anomalous request patterns, especially payloads containing SQL metacharacters such as ', --, ;, or UNION
Enable SQL Server auditing on the TeleControl database to record query text and detect concatenated statements originating from the service account
Alert on process creation events where the parent process is the TeleControl service and the child is cmd.exe, powershell.exe, or sqlservr.exe invoking shell extensions

Monitoring Recommendations

Forward Windows Security and Sysmon logs from TeleControl hosts to a centralized SIEM for correlation
Track authentication events against the TeleControl application and flag privileged actions following failed authorization attempts
Baseline normal database traffic from the application account and alert on deviations in query volume or structure

How to Mitigate CVE-2025-32846

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens advisory SSA-443402
Restrict network access to TCP port 8000 to trusted engineering workstations only, using firewall rules or network segmentation
Audit existing application accounts and revoke credentials that are no longer required to reduce the authenticated attack surface
Review database and Windows event logs for signs of prior exploitation against the LockGeneralSettings method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates this SQL injection issue. Apply the update on all affected installations. Full vendor guidance is available in the Siemens Security Advisory SSA-443402.

Workarounds

Place the TeleControl server inside a segmented control-system network with no direct exposure to corporate or internet traffic
Enforce host-based firewall rules that permit port 8000 connections only from explicitly authorized client IP addresses
Operate the TeleControl host according to Siemens operational guidelines for industrial security, including defense-in-depth controls

bash

# Example Windows firewall rule restricting access to port 8000
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
    dir=in action=allow protocol=TCP localport=8000 ^
    remoteip=10.10.20.0/24 profile=any

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
    dir=in action=block protocol=TCP localport=8000