CVE-2025-32852: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32852 Overview

CVE-2025-32852 is a SQL injection vulnerability [CWE-89] affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used LockDatabaseSettings method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to port 8000 can exploit this weakness to bypass authorization controls, read and modify database contents, and execute code with NT AUTHORITY\NetworkService privileges. Siemens disclosed the issue in advisory SSA-443402 and released a fixed version. The vulnerability affects industrial telecontrol infrastructure used in supervisory control and data acquisition (SCADA) environments.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService on Siemens TeleControl Server Basic hosts, compromising industrial telecontrol operations.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Component identifier: siemens:telecontrol_server_basic
Deployments exposing TCP port 8000 to reachable networks

Discovery Timeline

2025-04-16 - CVE-2025-32852 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32852

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the LockDatabaseSettings method exposed by TeleControl Server Basic. The method concatenates attacker-influenced input directly into SQL statements without parameterization or sanitization. Because the method is invoked through the authenticated service interface on port 8000, any low-privileged authenticated user can supply crafted SQL fragments through the call path.

Successful injection allows arbitrary reads and writes against the application's backing database. Beyond data manipulation, the injection chain enables command execution under the NT AUTHORITY\NetworkService account that hosts the service process. This bypasses the application's authorization model and grants attackers control over telecontrol configuration data.

The EPSS probability for this issue is currently low at 0.054%, but the high impact on confidentiality, integrity, and availability in industrial environments warrants prompt remediation.

Root Cause

The LockDatabaseSettings method builds SQL queries by string concatenation rather than using parameterized queries or prepared statements. The internal nature of the method led to insufficient input validation, since developers did not anticipate authenticated callers reaching this code path with malicious payloads.

Attack Vector

An attacker must reach TCP port 8000 on the affected host and authenticate with valid application credentials. After authentication, the attacker triggers the vulnerable code path and supplies malicious SQL through the parameters consumed by LockDatabaseSettings. The injected statements run with the privileges of the database connection, and chained execution yields operating system command execution as NT AUTHORITY\NetworkService.

No proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Siemens Security Advisory SSA-443402 for additional technical detail.

Detection Methods for CVE-2025-32852

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService
Anomalous SQL statements in database transaction logs referencing system stored procedures such as xp_cmdshell
Inbound connections to TCP port 8000 from hosts outside the engineering management subnet
Modifications to TeleControl configuration tables that do not correspond to operator activity

Detection Strategies

Inspect application and database logs for SQL syntax fragments, stacked queries, or comment sequences within parameters passed to internal methods
Correlate authentication events on the TeleControl service with subsequent database write operations and process creation events on the host
Alert on any process creation by the TeleControl service binary that launches command interpreters such as cmd.exe or powershell.exe

Monitoring Recommendations

Enable verbose audit logging on the SQL Server instance backing TeleControl Server Basic and forward logs to a centralized analytics platform
Baseline network flows to TCP port 8000 and alert on connections from unexpected source addresses
Monitor service account behavior for NT AUTHORITY\NetworkService to identify deviations from documented operational patterns

How to Mitigate CVE-2025-32852

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens advisory SSA-443402
Restrict network access to TCP port 8000 using host firewalls and network segmentation, allowing only authorized engineering workstations
Rotate credentials for all accounts with access to the TeleControl service following the upgrade
Audit recent database activity and host process creation history for signs of prior exploitation

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to address CVE-2025-32852. Customers should obtain the update through standard Siemens distribution channels and follow the upgrade guidance in the Siemens Security Advisory SSA-443402.

Workarounds

Limit port 8000 exposure to a dedicated management VLAN reachable only by engineering hosts
Enforce strict firewall rules and host-based access control lists where the patch cannot be applied immediately
Apply the Siemens operational guidelines for securing industrial control systems, including defense-in-depth and least-privilege principles

bash

# Example Windows firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.50.0/24
netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000