CVE-2025-32856: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32856 Overview

CVE-2025-32856 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used LockBufferingSettings method. An authenticated remote attacker with access to port 8000 can bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. TeleControl Server Basic is used in industrial automation environments to manage remote terminal units (RTUs), making this issue relevant to operational technology (OT) deployments.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and gain full read/write access to the application database.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial environments using TeleControl Server Basic for RTU management

Discovery Timeline

2025-04-16 - CVE-2025-32856 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32856

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the LockBufferingSettings method exposed by the TeleControl Server Basic application. The method accepts attacker-controlled input that is concatenated into a SQL query without proper parameterization or sanitization. Because the method is reachable by any authenticated client that can connect to port 8000, low-privileged user credentials are sufficient for exploitation. Successful injection allows the attacker to read or modify arbitrary database content and pivot to operating system command execution through database-level facilities, ultimately running code with the privileges of the service account NT AUTHORITY\NetworkService.

Root Cause

The root cause is missing input validation and the use of dynamic SQL construction in the LockBufferingSettings handler. The method also fails to enforce authorization checks consistent with the requested action, which allows authenticated low-privileged users to invoke functionality that bypasses intended access controls.

Attack Vector

Exploitation requires network reachability to TCP port 8000 on a host running an affected version of TeleControl Server Basic and valid authentication to the application. The attacker submits a crafted request invoking the LockBufferingSettings method with malicious SQL payloads. The server executes the injected statements against the backing database, returning data, modifying records, or invoking stored procedures that yield command execution under the service account context.

No public proof-of-concept code is available. For technical specifics, refer to the Siemens Security Advisory SSA-443402.

Detection Methods for CVE-2025-32856

Indicators of Compromise

Unexpected inbound TCP connections to port 8000 on TeleControl Server Basic hosts from unfamiliar internal sources
Database transaction logs showing UPDATE, INSERT, or DELETE operations invoked through the LockBufferingSettings method
Child processes spawned by the TeleControl service running as NT AUTHORITY\NetworkService, especially cmd.exe, powershell.exe, or scripting interpreters
New or modified files in the TeleControl Server Basic installation directory created by the service account

Detection Strategies

Inspect application and database logs for SQL syntax errors or unusual query patterns originating from the LockBufferingSettings handler
Alert on process creation events where the TeleControl service spawns shell or scripting binaries
Monitor authentication events for repeated low-privileged logons followed by anomalous database activity

Monitoring Recommendations

Restrict and log all access to port 8000 using network access control lists and a deny-by-default firewall policy
Forward TeleControl Server Basic application logs and Windows Security and Sysmon events to a centralized SIEM for correlation
Establish a baseline of normal LockBufferingSettings invocations and alert on deviations in frequency or payload size

How to Mitigate CVE-2025-32856

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published by Siemens
Block external and untrusted internal access to TCP port 8000 until patching is complete
Audit application accounts and revoke or rotate credentials for users who do not require access
Review database and host logs for evidence of prior exploitation against the LockBufferingSettings method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate this vulnerability. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

Limit access to port 8000 to a defined allowlist of management workstations through host and perimeter firewalls
Place TeleControl Server Basic systems in a segmented OT network zone with no direct exposure to IT or internet-facing networks
Enforce strong authentication and the principle of least privilege for all TeleControl Server Basic user accounts
Reduce the privileges of the NT AUTHORITY\NetworkService-hosted service where supported by the operating environment

bash

# Example Windows firewall rule restricting port 8000 to an allowlisted management host
netsh advfirewall firewall add rule name="TeleControl-8000-Allowlist" ^
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.5

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000