CVE-2025-32854: Siemens Telecontrol Server SQL Injection

CVE-2025-32854 Overview

CVE-2025-32854 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used LockOpcSettings method and allows an authenticated remote attacker to inject arbitrary SQL statements. Successful exploitation lets attackers bypass authorization controls, read and write to the application database, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability is tracked under [CWE-89] and requires network access to TCP port 8000 on the host running the affected application.

Critical Impact

Authenticated attackers can execute code under the NT AUTHORITY\NetworkService account and gain full read/write access to the TeleControl Server Basic database.

Affected Products

• Siemens TeleControl Server Basic — all versions before V3.1.2.2
• Deployments exposing TCP port 8000 to untrusted networks
• Industrial control system environments using TeleControl Server Basic for SCADA telecontrol

Discovery Timeline

• 2025-04-16 - CVE-2025-32854 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32854

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the LockOpcSettings method of TeleControl Server Basic. The method accepts attacker-controlled input and concatenates it into a SQL statement without proper parameterization or sanitization. Because the method is reachable by any authenticated user, it provides a path to bypass authorization checks that would normally protect privileged database operations.

A successful injection grants the attacker the ability to read sensitive operational data, modify configuration records, and chain database functionality into operating system command execution. Code runs in the context of the NT AUTHORITY\NetworkService service account, which the application uses at runtime. This identity is sufficient to access network resources, manipulate the application's own files, and pivot within the operator network.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The LockOpcSettings method does not enforce parameterized queries, and authorization logic relies on the underlying SQL operation rather than on a separate access control layer. Authenticated low-privilege users therefore reach a code path that should be restricted.

Attack Vector

The attack vector is network-based. An attacker authenticates to the TeleControl Server Basic service over TCP port 8000 and issues a crafted request that invokes the LockOpcSettings method with malicious SQL payloads. The complete technical write-up is available in the Siemens Security Advisory SSA-443402.

// No verified public proof-of-concept code is available for CVE-2025-32854.
// Refer to Siemens advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-32854

Indicators of Compromise

• Unexpected child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
• Anomalous SQL statements in application or database logs referencing the LockOpcSettings method or containing SQL meta-characters such as ', ;, --, or UNION SELECT
• New, modified, or deleted rows in the TeleControl Server Basic database that do not correlate with operator activity
• Inbound connections to TCP port 8000 originating from systems outside the engineering or operations network

Detection Strategies

• Inspect TeleControl Server Basic application logs for repeated or malformed calls to the LockOpcSettings method.
• Enable database auditing on the backing database instance and alert on statements that combine DDL or xp_cmdshell-style operations with the service account.
• Correlate authentication events on TeleControl Server Basic with subsequent process creation events on the host.

Monitoring Recommendations

• Continuously monitor TCP port 8000 exposure with network sensors and alert on connections from untrusted segments.
• Baseline normal behavior of the NT AUTHORITY\NetworkService account on the host and alert on deviations such as command shell execution.
• Forward Windows process, network, and database telemetry to a centralized SIEM for cross-source correlation.

How to Mitigate CVE-2025-32854

Immediate Actions Required

• Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later as specified in Siemens Security Advisory SSA-443402.
• Restrict access to TCP port 8000 to a small set of authorized engineering workstations using host and network firewalls.
• Rotate credentials for all TeleControl Server Basic accounts after patching, assuming prior exposure may have leaked them.
• Review database contents and host file system for unauthorized modifications since the application was last verified.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the LockOpcSettings method. All earlier versions are affected and must be upgraded. Patch metadata and download instructions are available in the Siemens ProductCERT advisory.

Workarounds

• Block external access to TCP port 8000 on the TeleControl Server Basic host and permit only trusted operator subnets.
• Place the server behind a segmented industrial DMZ and require VPN authentication for any remote access.
• Limit TeleControl Server Basic user accounts to the minimum necessary and disable unused authenticated accounts to reduce the pool of attackers who can reach the vulnerable method.

# Example Windows firewall rule restricting TCP 8000 to a trusted subnet
netsh advfirewall firewall add rule name="TeleControl 8000 Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24
netsh advfirewall firewall add rule name="TeleControl 8000 Block" ^
  dir=in action=block protocol=TCP localport=8000