CVE-2025-32860: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-32860 Overview

CVE-2025-32860 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UnlockWebServerGatewaySettings method, which fails to properly sanitize user-supplied input before passing it to database queries. An authenticated remote attacker with access to port 8000 can bypass authorization controls, read and write to the application's database, and execute code with NT AUTHORITY\NetworkService permissions. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can execute code as NT AUTHORITY\NetworkService, bypass authorization, and gain full read/write access to the TeleControl database.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to attacker-reachable networks
Industrial control system environments using TeleControl Server Basic for SCADA telecontrol

Discovery Timeline

2025-04-16 - CVE-2025-32860 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32860

Vulnerability Analysis

The vulnerability exists in the UnlockWebServerGatewaySettings method exposed by TeleControl Server Basic on TCP port 8000. The method concatenates attacker-controlled input into SQL statements without parameterization or input sanitization. This classic CWE-89 flaw permits arbitrary SQL execution against the backing database.

Beyond data manipulation, the injection primitive escalates into remote code execution. Attackers leverage database-layer features to run commands under the NT AUTHORITY\NetworkService account. This service context has network access and can interact with other Windows resources on the host and connected networks.

The method is described as "internally used," yet reachable by any authenticated user. This design gap enables privilege boundary violations. An authenticated user with minimal application privileges effectively obtains database administrator and OS-level command execution.

Root Cause

The root cause is missing input validation and lack of parameterized queries in the UnlockWebServerGatewaySettings handler. The application assumes callers of internal methods are trusted, so authorization checks on the method are absent or insufficient. Combined with unsafe SQL string construction, this permits both authorization bypass and injection.

Attack Vector

Exploitation requires network reachability to port 8000 on the target and valid application credentials. Any authenticated user role is sufficient because the vulnerable method does not enforce role-based authorization. The attacker sends a crafted request invoking UnlockWebServerGatewaySettings with SQL metacharacters embedded in the input fields.

The injected SQL runs with the database service account privileges. Attackers commonly chain the injection with xp_cmdshell or equivalent stored procedures to spawn OS commands as NT AUTHORITY\NetworkService. From that foothold, lateral movement into ICS/SCADA network segments becomes feasible.

No public proof-of-concept exploit has been published for CVE-2025-32860, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Consult the Siemens Security Advisory SSA-443402 for authoritative technical details.

Detection Methods for CVE-2025-32860

Indicators of Compromise

Unexpected inbound TCP connections to port 8000 on TeleControl Server Basic hosts from non-operator workstations.
Database log entries showing anomalous queries containing SQL metacharacters, UNION SELECT, xp_cmdshell, or unusual stored procedure calls under the TeleControl service account.
New processes spawned by the TeleControl or SQL Server service running as NT AUTHORITY\NetworkService, especially cmd.exe, powershell.exe, or scripting hosts.
Modified or newly created rows in TeleControl configuration tables without a corresponding administrative session.

Detection Strategies

Enable SQL Server audit logging for the TeleControl database and alert on statements referencing UnlockWebServerGatewaySettings context or containing injection patterns.
Deploy network intrusion detection signatures for anomalous payloads targeting TCP port 8000 on TeleControl hosts.
Correlate application authentication events with subsequent database write activity to detect low-privileged users triggering privileged database operations.

Monitoring Recommendations

Monitor child processes of the TeleControl Server and SQL Server processes; flag any command interpreter or network utility execution.
Track outbound network connections from the NetworkService account to non-standard destinations, which may indicate command-and-control activity.
Review Windows Security event logs for logon events from the TeleControl service account outside expected operational windows.

How to Mitigate CVE-2025-32860

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as instructed in Siemens Security Advisory SSA-443402.
Restrict network access to TCP port 8000 using host-based and perimeter firewalls; permit only trusted engineering workstations.
Rotate credentials for all TeleControl application accounts and the underlying database service account following remediation.
Audit the TeleControl database and Windows host for signs of prior exploitation before returning the system to production.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 which remediates the SQL injection in the UnlockWebServerGatewaySettings method. Refer to Siemens Security Advisory SSA-443402 for the download location and full remediation guidance. Apply the patch during the next maintenance window and validate ICS functionality afterward.

Workarounds

Place the TeleControl Server on a dedicated, segmented network in line with Siemens ICS operational guidelines.
Block TCP port 8000 at the network boundary and permit access only from a jump host requiring multi-factor authentication.
Enforce least privilege on TeleControl application accounts and revoke access from users who do not require it.
Constrain the database service account so it cannot execute OS commands, for example by disabling xp_cmdshell on the SQL Server instance.

bash

# Example: block TCP 8000 except from a trusted management subnet on Windows
netsh advfirewall firewall add rule name="Deny TeleControl 8000 Inbound" ^
  dir=in action=block protocol=TCP localport=8000

netsh advfirewall firewall add rule name="Allow TeleControl 8000 from Mgmt" ^
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.20.0/24