CVE-2025-32851: Siemens Telecontrol Server Basic SQLi

CVE-2025-32851 Overview

CVE-2025-32851 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockTcmSettings method, which fails to properly sanitize input passed to database queries. An authenticated remote attacker with access to TCP port 8000 can exploit the issue to bypass authorization controls, read and write the application database, and execute code under the NT AUTHORITY\NetworkService account.

Critical Impact
Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService on industrial control infrastructure managing remote SCADA stations.

Affected Products

Siemens TeleControl Server Basic — All versions prior to V3.1.2.2
Component: siemens:telecontrol_server_basic
Vendor: Siemens

Discovery Timeline

2025-04-16 - CVE-2025-32851 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32851

Vulnerability Analysis

The vulnerability exists in the UnlockTcmSettings method used internally by TeleControl Server Basic. The method concatenates attacker-controlled input directly into SQL statements without parameterization or proper escaping. This allows an authenticated user to inject arbitrary SQL syntax into the underlying database query.

Because the affected service runs as NT AUTHORITY\NetworkService, successful exploitation extends beyond data tampering. Attackers can leverage SQL Server extended stored procedures or other database engine features to execute operating system commands within that service context, depending on database privileges. This converts a data layer flaw into a remote code execution primitive.

The service exposes TCP port 8000, which must be reachable from the attacker's network position. Siemens advises restricting this port at the network perimeter as a compensating control.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The UnlockTcmSettings method builds dynamic SQL with untrusted input rather than using parameterized queries or prepared statements. Authorization checks within the method are also bypassable through the injection itself.

Attack Vector

Exploitation requires network reachability to port 8000 and valid low-privilege application credentials. The attacker submits a crafted request that triggers the UnlockTcmSettings code path with malicious SQL syntax embedded in a parameter. Once the payload reaches the database, it executes under the privileges of the application's database connection. The vulnerability is described in prose only — no public proof-of-concept exploit is available at the time of writing. Refer to the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-32851

Indicators of Compromise

Unexpected inbound TCP connections to port 8000 on systems running TeleControl Server Basic from non-administrative hosts.
Anomalous child processes spawned by the TeleControl service running under NT AUTHORITY\NetworkService.
Database log entries showing malformed or unusually long parameters passed to procedures invoked by UnlockTcmSettings.
Creation of new database users, modifications to stored procedures, or enablement of xp_cmdshell on the backing SQL instance.

Detection Strategies

Enable verbose SQL audit logging on the TeleControl database and alert on syntax errors, UNION, EXEC, or comment sequences within parameters.
Inspect application logs for failed authorization events followed immediately by successful access to settings endpoints.
Deploy network monitoring rules to flag non-baseline clients connecting to port 8000.

Monitoring Recommendations

Baseline normal traffic patterns to the TeleControl Server and alert on deviations in source IP, request volume, or payload size.
Forward Windows Security and application event logs from the TeleControl host to a central SIEM for correlation.
Monitor process creation events under the NetworkService account and treat shell or scripting interpreter launches as high-severity events.

How to Mitigate CVE-2025-32851

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as published in Siemens Security Advisory SSA-443402.
Restrict inbound access to TCP port 8000 to trusted engineering workstations using host and network firewalls.
Rotate credentials for all TeleControl application accounts after patching to invalidate any previously captured logins.
Audit the TeleControl database for unauthorized accounts, modified stored procedures, or unexpected schema changes.

Patch Information

Siemens has released fixed version V3.1.2.2. Apply the update referenced in the Siemens Security Advisory SSA-443402. After upgrading, verify the patched binary version through the application's About dialog and confirm that the database service account follows least-privilege principles.

Workarounds

Place the TeleControl Server Basic host behind a segmented OT firewall and permit port 8000 only from authorized management subnets.
Disable or remove unused application accounts and enforce strong password policies for remaining users.
Where feasible, run the underlying SQL Server with xp_cmdshell disabled and the service account stripped of sysadmin rights to limit RCE potential.

bash

# Example Windows Firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000