CVE-2025-32847: Siemens Telecontrol Server Basic SQLi

CVE-2025-32847 Overview

CVE-2025-32847 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used UnlockGeneralSettings method, which fails to properly sanitize user-supplied input before incorporating it into SQL queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and modify the application database, and execute code in the context of the NT AUTHORITY\NetworkService account. The vulnerability impacts industrial control system (ICS) environments where TeleControl Server Basic manages remote terminal units (RTUs) over telecontrol protocols.

Critical Impact

Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and gain full control over the application database.

Affected Products

• Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
• Deployments exposing TCP port 8000 to untrusted networks
• Industrial control environments using TeleControl Server Basic for RTU communications

Discovery Timeline

• 2025-04-16 - CVE-2025-32847 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32847

Vulnerability Analysis

The vulnerability exists within the UnlockGeneralSettings method, an internal handler exposed through the TeleControl Server Basic service on TCP port 8000. The method concatenates attacker-controlled input directly into SQL statements without parameterization, enabling injection of arbitrary SQL syntax. Because the method is reachable post-authentication but lacks proper authorization checks, low-privileged accounts can pivot to database-level operations they should not access.

Successful exploitation grants read and write access to backend database tables. The injection chain extends further: the database engine permits operations that lead to arbitrary command execution within the host process. The service runs as NT AUTHORITY\NetworkService, giving the attacker code execution privileges sufficient to access network resources and interact with other Windows services.

This is particularly relevant in operational technology (OT) environments where TeleControl Server Basic mediates SCADA traffic. Database tampering can corrupt telecontrol configurations, modify RTU mappings, or disrupt industrial process visibility.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The UnlockGeneralSettings method builds SQL queries through string concatenation rather than parameterized statements or prepared queries. Authorization enforcement on the internal method is also insufficient, allowing authenticated users without administrative rights to invoke it.

Attack Vector

The attack requires network access to port 8000 on the host running TeleControl Server Basic and valid authentication credentials. The attacker sends a crafted request invoking the UnlockGeneralSettings method with malicious SQL payload embedded in a parameter. The injected SQL executes against the application database, after which the attacker leverages database functionality to write files or execute commands as NT AUTHORITY\NetworkService.

The vulnerability is described in prose only because no public proof-of-concept exploit is currently available. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32847

Indicators of Compromise

• Unexpected inbound connections to TCP port 8000 from systems outside the engineering workstation subnet.
• Process creation events spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService.
• Anomalous SQL statements in application or database logs referencing the UnlockGeneralSettings operation.
• New or modified rows in TeleControl Server Basic configuration tables outside normal change windows.

Detection Strategies

• Monitor authentication and request logs on the TeleControl Server Basic service for repeated UnlockGeneralSettings invocations from a single account.
• Inspect database query logs for SQL syntax patterns indicative of injection, such as stacked queries, comment sequences, or xp_cmdshell invocations.
• Alert on child processes of the TeleControl Server Basic service binary, particularly cmd.exe, powershell.exe, or scripting hosts.
• Correlate network connections originating from the NetworkService account context with file write activity in non-standard directories.

Monitoring Recommendations

• Forward Windows Security, Sysmon, and application logs from TeleControl Server hosts to a centralized SIEM for correlation.
• Implement network monitoring rules that flag port 8000 traffic crossing OT/IT boundaries.
• Baseline the legitimate parent-child process tree of the TeleControl Server service and alert on deviations.
• Review database audit logs daily for schema or privilege changes within the TeleControl Server Basic database.

How to Mitigate CVE-2025-32847

Immediate Actions Required

• Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens.
• Restrict access to TCP port 8000 using host-based and network firewalls so only authorized engineering workstations can reach it.
• Rotate credentials for all accounts able to authenticate to TeleControl Server Basic.
• Audit the application database for unauthorized modifications and unexpected stored procedures.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate this vulnerability. Customers should obtain the update through standard Siemens support channels. Full remediation guidance is published in Siemens Security Advisory SSA-443402.

Workarounds

• Segment TeleControl Server Basic into a dedicated OT network zone protected by a stateful firewall.
• Block external access to port 8000 and require VPN or jump host access for administrative connections.
• Enforce least-privilege accounts for users who must authenticate to the application.
• Apply Siemens operational guidelines for industrial security and the IEC 62443 defense-in-depth recommendations.

# Example Windows firewall rule restricting access to port 8000
netsh advfirewall firewall add rule name="TeleControl Server Basic - Restrict 8000" ^
  dir=in action=block protocol=TCP localport=8000 remoteip=any

netsh advfirewall firewall add rule name="TeleControl Server Basic - Allow Engineering" ^
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.0/24