CVE-2025-32855: Siemens Telecontrol Server Basic SQLi

CVE-2025-32855 Overview

CVE-2025-32855 is a SQL injection vulnerability [CWE-89] affecting Siemens TeleControl Server Basic in all versions before V3.1.2.2. The flaw resides in the internally used UnlockOpcSettings method, which fails to sanitize input passed to backend database queries. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. Siemens TeleControl Server Basic is widely deployed in industrial control system (ICS) environments to manage remote SCADA stations, raising the operational risk of successful exploitation.

Critical Impact
Authenticated attackers with network access to port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with the underlying database backing industrial telecontrol operations.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
ICS/SCADA environments relying on TeleControl Server Basic for remote station management

Discovery Timeline

2025-04-16 - CVE-2025-32855 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32855

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the UnlockOpcSettings internal method exposed by TeleControl Server Basic. User-controllable parameters reach a SQL statement without parameterization or adequate input validation. Because the method runs inside the application service, exploitation grants attackers the privileges of the host process, NT AUTHORITY\NetworkService. The injection point sits behind authentication, but the same flaw enables authorization bypass once authenticated access is established. Attackers can therefore escalate from a low-privileged application account to broader database and operating system actions. The service listens on TCP port 8000, which provides the network reachability required for remote exploitation.

Root Cause

The UnlockOpcSettings method concatenates attacker-controlled input directly into SQL queries instead of using prepared statements or parameter binding. This unsafe query construction allows injected clauses to alter query logic, bypass intended access checks, and invoke database-level functionality that translates into code execution on the host.

Attack Vector

Exploitation requires network reachability to port 8000 on a system running a vulnerable version, plus authenticated access to the application. The attacker submits crafted input to the UnlockOpcSettings method, where injected SQL alters server-side query execution. Successful injection enables data exfiltration, data tampering, and command execution under the service account. See the Siemens Security Advisory SSA-443402 for vendor-confirmed exploitation prerequisites.

Detection Methods for CVE-2025-32855

Indicators of Compromise

Unexpected authenticated sessions to TeleControl Server Basic on TCP port 8000 originating from non-engineering subnets.
Database modifications or new records in the TeleControl Server Basic backend that do not correlate with operator workflows.
Child processes spawned by the TeleControl service running under NT AUTHORITY\NetworkService.
Outbound network connections initiated from the TeleControl service host to unfamiliar destinations.

Detection Strategies

Inspect application and database logs for anomalous query patterns referencing UnlockOpcSettings or unusual SQL syntax such as stacked queries and xp_cmdshell invocations.
Apply network-based detection for crafted payloads sent to TCP port 8000 and correlate with authentication events.
Baseline normal process trees for the TeleControl Server Basic service and alert on deviations, particularly shell or scripting interpreters launched as NetworkService.

Monitoring Recommendations

Forward Windows Security, application, and database audit logs from TeleControl Server Basic hosts to a centralized analytics platform for correlation.
Continuously monitor authentication failures and brute-force attempts against the TeleControl application, which is a prerequisite for exploitation.
Track changes to TeleControl configuration tables and OPC settings to detect tampering downstream of a successful injection.

How to Mitigate CVE-2025-32855

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed in Siemens Security Advisory SSA-443402.
Restrict network access to TCP port 8000 to a small set of authorized engineering workstations using host and perimeter firewalls.
Rotate credentials for all accounts able to authenticate to TeleControl Server Basic following patching.
Review database and host logs for signs of prior exploitation before declaring systems clean.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UnlockOpcSettings method. Customers should obtain the fixed version through Siemens Industry Online Support and follow the upgrade procedure outlined in the vendor advisory.

Workarounds

Place TeleControl Server Basic behind a segmented ICS network and block TCP port 8000 from general corporate and internet-facing zones.
Enforce least privilege on accounts authorized to authenticate to the TeleControl application, removing unused or shared credentials.
Apply Siemens' general ICS hardening guidance, including disabling unused services and ensuring the host runs with current OS security updates.

bash

# Example Windows firewall rule restricting TCP/8000 to a trusted engineering subnet
New-NetFirewallRule -DisplayName "TeleControl-8000-Restrict" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -RemoteAddress 10.20.30.0/24 `
  -Action Allow

New-NetFirewallRule -DisplayName "TeleControl-8000-Block-Other" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -Action Block