CVE-2025-32859: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32859 Overview

CVE-2025-32859 is a SQL injection vulnerability [CWE-89] affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used LockWebServerGatewaySettings method, which fails to sanitize input before constructing database queries. An authenticated remote attacker with access to port 8000 can bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 to address the issue.

Critical Impact
Authenticated attackers can achieve code execution as NT AUTHORITY\NetworkService on industrial telecontrol servers, compromising operational technology environments that bridge SCADA infrastructure and corporate networks.

Affected Products

Siemens TeleControl Server Basic (All versions prior to V3.1.2.2)
Deployments exposing TCP port 8000 to authenticated users
Industrial control system environments using TeleControl Server Basic for SINAUT ST7 communications

Discovery Timeline

2025-04-16 - CVE-2025-32859 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32859

Vulnerability Analysis

The vulnerability resides in the LockWebServerGatewaySettings method, which is used internally by TeleControl Server Basic. The method accepts attacker-controlled input and incorporates it directly into SQL statements without parameterization or sanitization. This allows an authenticated attacker to inject arbitrary SQL syntax into queries executed by the backend database engine.

Because the application processes these queries with the privileges of the NT AUTHORITY\NetworkService service account, successful exploitation extends beyond data manipulation. Attackers can leverage database-level stored procedures or extended functionality to execute operating system commands. The vulnerability also enables bypass of authorization controls intended to restrict sensitive operations to privileged users.

TeleControl Server Basic is widely deployed in utility, water, and energy sectors as a SCADA gateway. Compromise of this component grants attackers a foothold in operational technology networks and the ability to influence telecontrol communications with remote stations.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The LockWebServerGatewaySettings method concatenates untrusted input directly into SQL queries rather than using parameterized statements or prepared queries. Authorization checks for this internal method are also insufficient, allowing low-privileged authenticated users to invoke it.

Attack Vector

Exploitation requires network access to TCP port 8000 on the host running TeleControl Server Basic and valid authentication credentials. The attacker submits crafted input to the vulnerable method, which is then incorporated into a SQL query. Successful injection allows arbitrary database read and write operations and, through database engine features, command execution as the service account. No user interaction is required beyond the attacker's authenticated session.

The vulnerability mechanism is described in the Siemens Security Advisory SSA-443402. No public proof-of-concept exploit code is currently available.

Detection Methods for CVE-2025-32859

Indicators of Compromise

Unexpected outbound connections or new processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
Database log entries showing anomalous queries originating from the LockWebServerGatewaySettings code path
Authentication events on TCP port 8000 from unexpected source addresses or at unusual times
New or modified database objects, stored procedures, or extended procedures in the TeleControl Server Basic database

Detection Strategies

Inspect SQL query logs for syntactically anomalous statements containing union, comment markers, or stacked queries against the TeleControl database
Monitor process creation events where the parent process is the TeleControl Server Basic service to identify command execution chains
Implement network-based detection for malformed payloads sent to port 8000 on TeleControl hosts
Baseline normal authentication patterns and alert on access by accounts that do not typically interact with the service

Monitoring Recommendations

Forward Windows Security, Application, and TeleControl-specific logs to a centralized SIEM for correlation with network telemetry
Enable database-level auditing on the TeleControl Server Basic instance to capture all statement execution
Monitor for changes to the NT AUTHORITY\NetworkService token usage patterns, including unexpected file or registry writes
Track network flows to and from port 8000 and alert on connections originating outside the engineering management subnet

How to Mitigate CVE-2025-32859

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as provided in Siemens advisory SSA-443402
Restrict access to TCP port 8000 to trusted engineering workstations using host-based and network firewalls
Rotate credentials for all accounts capable of authenticating to TeleControl Server Basic
Audit the TeleControl database for unauthorized modifications, new accounts, or unexpected stored procedures

Patch Information

Siemens released TeleControl Server Basic V3.1.2.2 to remediate this vulnerability. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402. Administrators should validate patch deployment in a staging environment that mirrors production telecontrol configurations before rolling out to operational systems.

Workarounds

Apply network segmentation to isolate TeleControl Server Basic hosts within a dedicated industrial control system zone
Block external access to TCP port 8000 at perimeter and internal firewalls until patching is complete
Enforce the principle of least privilege for application accounts and remove unused user accounts from the application
Follow Siemens operational guidelines for securing industrial environments as referenced in SSA-443402

bash

# Example Windows firewall rule restricting port 8000 to a trusted management host
netsh advfirewall firewall add rule name="Restrict TeleControl 8000" ^
  dir=in action=block protocol=TCP localport=8000

netsh advfirewall firewall add rule name="Allow TeleControl 8000 Mgmt" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.5