CVE-2025-32850: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32850 Overview

CVE-2025-32850 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used LockTcmSettings method, which fails to properly sanitize input before constructing SQL queries [CWE-89]. An authenticated remote attacker with access to port 8000 on a vulnerable host can bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability impacts industrial telecontrol environments where the server bridges SCADA systems and remote stations.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and gain full read/write access to the application database.

Affected Products

Siemens TeleControl Server Basic (all versions before V3.1.2.2)
Deployments exposing TCP port 8000 to untrusted networks
Industrial environments using TeleControl Server Basic for SCADA integration

Discovery Timeline

2025-04-16 - CVE-2025-32850 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32850

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements used in a SQL command [CWE-89]. The LockTcmSettings method, invoked internally during settings lock operations, concatenates attacker-controllable input into SQL statements without parameterization. An authenticated user with low privileges can inject crafted SQL fragments that the database engine then executes with the privileges of the TeleControl Server Basic service account.

Because the affected service runs as NT AUTHORITY\NetworkService, successful injection allows attackers to leverage database-level command execution primitives, such as stored procedures or extended functionality, to run operating system commands. This converts a database-layer injection into full host code execution within the industrial control environment.

Root Cause

The root cause is the absence of prepared statements or input validation in the LockTcmSettings method. The application treats authenticated callers as trusted for this internal path, but the parameters carried over remote interfaces are not sanitized. Authorization checks downstream of the injection point can be bypassed because the injected SQL alters the query logic itself.

Attack Vector

Exploitation requires network access to port 8000 on the host running TeleControl Server Basic and valid authentication credentials. The attacker invokes the affected method with a crafted payload that breaks out of the intended query context. No user interaction is required, and the attack complexity is low. Refer to the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-32850

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
Anomalous SQL queries in application or database logs containing SQL meta-characters within the LockTcmSettings code path
New or modified database accounts, stored procedures, or scheduled tasks on the affected host
Outbound connections from the TeleControl server to non-operational network destinations

Detection Strategies

Inspect application logs for malformed parameters submitted to the LockTcmSettings method
Correlate authenticated session activity on port 8000 with database write operations outside normal operator workflows
Alert on process lineage where cmd.exe, powershell.exe, or scripting engines are spawned from the TeleControl Server Basic service

Monitoring Recommendations

Enable verbose authentication and query auditing on the TeleControl database backend
Forward host process telemetry and network flows for port 8000 to a centralized analytics platform for behavioral baselining
Monitor for privilege use by the NetworkService account that deviates from documented application behavior

How to Mitigate CVE-2025-32850

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published by Siemens
Restrict network access to TCP port 8000 to a defined allowlist of engineering workstations
Rotate credentials for all accounts authorized to authenticate to the TeleControl service
Audit the application database for unauthorized schema changes, accounts, or stored procedures

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate CVE-2025-32850. The fix addresses the SQL injection in the LockTcmSettings method and is documented in the Siemens Security Advisory SSA-443402. Operators should plan an upgrade within a change window appropriate for industrial control systems.

Workarounds

Place the TeleControl server behind a firewall and permit port 8000 only from trusted engineering hosts
Segment the OT network using a demilitarized zone between corporate IT and control systems per Siemens operational guidelines
Disable or restrict accounts that do not require access to the TeleControl Server Basic management interface

bash

# Example Windows firewall rule restricting port 8000 to a trusted subnet
netsh advfirewall firewall add rule name="Restrict TeleControl 8000" \
    dir=in action=block protocol=TCP localport=8000
netsh advfirewall firewall add rule name="Allow TeleControl 8000 trusted" \
    dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.0/24