CVE-2025-32849: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32849 Overview

CVE-2025-32849 is a SQL injection vulnerability [CWE-89] affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockSmtpSettings method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 addressing the issue.

Critical Impact

Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with the application database used to manage telecontrol stations.

Affected Products

• Siemens TeleControl Server Basic — all versions before V3.1.2.2
• Deployments exposing TCP port 8000 to untrusted networks
• SCADA/ICS environments relying on the affected server for RTU communications

Discovery Timeline

• 2025-04-16 - CVE-2025-32849 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32849

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the UnlockSmtpSettings method exposed by TeleControl Server Basic. The method concatenates attacker-controlled input into a SQL statement without parameterization. Because the underlying database connection runs with elevated permissions, exploitation extends beyond data tampering to remote code execution through database-side functionality such as xp_cmdshell or equivalent stored procedure abuse.

The service hosting the vulnerable method listens on TCP port 8000. Successful exploitation requires valid authentication, which limits unauthenticated mass exploitation. However, low-privilege accounts are sufficient to reach the vulnerable method, and TeleControl Server Basic operators frequently rely on shared or weak credentials in operational technology (OT) environments. The EPSS probability stands at 0.525%.

Root Cause

The UnlockSmtpSettings method composes SQL queries through string concatenation instead of using parameterized statements or prepared queries. Authorization checks performed by the application layer can be bypassed when the underlying query is manipulated, allowing the attacker to alter authentication state and access controls through the database itself.

Attack Vector

An attacker authenticates to the TeleControl Server Basic instance over the network and invokes the UnlockSmtpSettings method with a crafted payload. The malicious SQL fragment is executed by the backend database engine. Because the database process inherits NT AUTHORITY\NetworkService privileges, the attacker can pivot from query execution to operating-system command execution on the Windows host running the server.

No verified public proof-of-concept is currently available. Refer to the Siemens Security Advisory SSA-443402 for vendor-confirmed technical details.

Detection Methods for CVE-2025-32849

Indicators of Compromise

• Unexpected NetworkService-spawned child processes such as cmd.exe, powershell.exe, or rundll32.exe originating from the TeleControl Server Basic process tree
• Anomalous outbound connections from the TeleControl host following authenticated sessions to port 8000
• Database audit entries showing UnlockSmtpSettings invocations containing SQL meta-characters (', --, ;, UNION, xp_)
• New or modified rows in authentication, configuration, or SMTP-related tables that do not align with operator activity

Detection Strategies

• Enable verbose request logging on TeleControl Server Basic and alert on calls to UnlockSmtpSettings from non-administrative accounts
• Deploy network detection rules that inspect traffic to TCP 8000 for SQL injection signatures targeting the method name
• Correlate authentication events with subsequent NetworkService process creation on the host to surface post-exploitation activity

Monitoring Recommendations

• Forward Windows process creation (Event ID 4688) and authentication logs from the TeleControl host to a centralized analytics platform
• Monitor database server logs for unusual stored procedure execution under the TeleControl application account
• Baseline normal API call patterns to the management service and alert on deviations involving SMTP configuration methods

How to Mitigate CVE-2025-32849

Immediate Actions Required

• Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens advisory SSA-443402
• Restrict network access to TCP port 8000 so that only trusted engineering workstations can reach the management interface
• Rotate credentials for all TeleControl Server Basic accounts and enforce strong, unique passwords
• Review database audit logs for prior abuse of the UnlockSmtpSettings method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 containing the fix. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

• Place TeleControl Server Basic behind a firewall that enforces source-IP allow-listing for port 8000
• Segment the OT network according to IEC 62443 zone-and-conduit principles to limit reachability of the management service
• Disable or remove unused application accounts to reduce the authenticated attack surface

# Example Windows firewall rule restricting port 8000 to a trusted engineering subnet
netsh advfirewall firewall add rule name="TeleControl Mgmt - Restrict 8000" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24
netsh advfirewall firewall add rule name="TeleControl Mgmt - Block 8000" ^
  dir=in action=block protocol=TCP localport=8000