CVE-2025-32858: Siemens Telecontrol Server Basic SQLi

CVE-2025-32858 Overview

CVE-2025-32858 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateWebServerGatewaySettings method, which fails to sanitize input before constructing database queries. An authenticated remote attacker with access to port 8000 can bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The weakness is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with telecontrol database contents used to manage SCADA endpoints.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 to authenticated users
Industrial environments using TeleControl Server Basic as a SCADA gateway

Discovery Timeline

2025-04-16 - CVE-2025-32858 published to NVD
2025-04-16 - Siemens publishes advisory SSA-443402
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32858

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input within the UpdateWebServerGatewaySettings method. This method is reached through the application's network interface on port 8000 and processes parameters that are concatenated directly into SQL statements. Because the method is described as internally used, authorization checks around it are weaker than those guarding documented external endpoints. An authenticated user can therefore reach a code path that the developers did not intend to be operator-accessible.

Once the attacker reaches this code path, the SQL injection primitive provides read and write access to the application database. The injected statements execute under the service account context, which on Windows is NT AUTHORITY\NetworkService. Attackers can chain the SQL injection with stored procedure abuse or filesystem operations to achieve arbitrary code execution at that privilege level.

Root Cause

The root cause is direct concatenation of attacker-controlled values into SQL queries inside UpdateWebServerGatewaySettings, combined with insufficient authorization checks for an internal method that is reachable over the network. Parameterized queries and a stricter authorization boundary on internal RPC-style endpoints would prevent both effects.

Attack Vector

Exploitation requires network access to port 8000 on a host running a vulnerable TeleControl Server Basic instance and valid credentials on the application. The attacker submits a crafted request invoking UpdateWebServerGatewaySettings with malicious SQL fragments embedded in its parameters. The server executes the injected statements against the backing database, returning data or performing writes. From there, escalation to command execution is achieved through database-level mechanisms running under the service identity.

No verified public proof-of-concept code is currently available. See the Siemens Security Advisory SSA-443402 for vendor-provided technical detail.

Detection Methods for CVE-2025-32858

Indicators of Compromise

Unexpected authenticated sessions to TeleControl Server Basic on TCP port 8000 from non-operator hosts
Database writes or schema changes attributed to the NT AUTHORITY\NetworkService account outside normal maintenance windows
Process creations spawned by the TeleControl Server service that invoke cmd.exe, powershell.exe, or scripting hosts
Application or database logs containing SQL meta-characters (', --, ;, xp_) inside parameters to UpdateWebServerGatewaySettings

Detection Strategies

Inspect TeleControl Server Basic application logs for invocations of the internal UpdateWebServerGatewaySettings method originating from non-administrative users.
Monitor the backing SQL database for unusual xp_cmdshell, sp_OACreate, or bulk update activity correlated with TeleControl service requests.
Apply network-level deep packet inspection to traffic destined for port 8000, flagging payloads containing SQL injection signatures.

Monitoring Recommendations

Enable verbose authentication and method-level auditing within TeleControl Server Basic and forward logs to a central SIEM.
Baseline the typical set of source IPs that authenticate to the TeleControl management interface and alert on deviations.
Track child processes of the TeleControl service to detect command execution under NT AUTHORITY\NetworkService.

How to Mitigate CVE-2025-32858

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as published in Siemens advisory SSA-443402.
Restrict access to TCP port 8000 to dedicated engineering workstations using host and network firewalls.
Rotate all TeleControl Server Basic application credentials and review accounts for least-privilege scope.
Audit the application database and Windows event logs for prior exploitation indicators since the system was first exposed.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateWebServerGatewaySettings method. Patch details and download instructions are available in Siemens Security Advisory SSA-443402. Operators should validate patch deployment against the vendor checksum and confirm the updated version string after installation.

Workarounds

Block external access to port 8000 at perimeter and segmentation firewalls, allowing only trusted engineering hosts.
Place TeleControl Server Basic inside a dedicated OT security zone, following IEC 62443 network segmentation guidance.
Disable or restrict application accounts that are not required for day-to-day telecontrol operations.
Require VPN with multi-factor authentication for any remote access to the TeleControl management interface.

bash

# Example Windows Firewall rule restricting access to port 8000
# to a specific engineering workstation subnet
netsh advfirewall firewall add rule ^
  name="TeleControl 8000 - Engineering Only" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule ^
  name="TeleControl 8000 - Block Other" ^
  dir=in action=block protocol=TCP localport=8000