CVE-2025-32861: Siemens Telecontrol Server Basic SQLi

CVE-2025-32861 Overview

CVE-2025-32861 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateTraceLevelSettings method. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify the application database, and execute code under the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 describing the issue.

Critical Impact

Authenticated attackers with network access to port 8000 can execute code as NT AUTHORITY\NetworkService and gain full read/write access to the TeleControl Server database.

Affected Products

• Siemens TeleControl Server Basic — all versions prior to V3.1.2.2

Discovery Timeline

• 2025-04-16 - CVE-2025-32861 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32861

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the UpdateTraceLevelSettings method exposed by TeleControl Server Basic. The method accepts attacker-controlled input that is concatenated into a SQL statement without sufficient sanitization or parameterization. Because the method is reachable through the application's network interface on port 8000, an authenticated user can issue crafted requests that alter the intended query.

Exploitation lets the attacker bypass authorization checks enforced at higher layers of the application. The injected SQL runs against the backend database with the privileges of the service account hosting TeleControl Server, which is NT AUTHORITY\NetworkService on Windows hosts. From this position, the attacker can read sensitive configuration data, modify operational records used by SCADA telecontrol workflows, and leverage database features to execute operating system commands.

Root Cause

The UpdateTraceLevelSettings method does not adequately validate or parameterize user-supplied parameters before constructing SQL statements. The function also fails to enforce authorization checks consistent with the rest of the application, allowing low-privileged authenticated users to reach a privileged code path.

Attack Vector

The attack vector is the network. An attacker must hold valid application credentials and be able to reach TCP port 8000 on the host running a vulnerable version of TeleControl Server Basic. No user interaction is required. Successful exploitation yields database read/write access and code execution under the service account.

The vulnerability is reachable via authenticated requests to the
UpdateTraceLevelSettings method exposed on TCP port 8000. No public
proof-of-concept code has been released. Refer to Siemens advisory
SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-32861

Indicators of Compromise

• Unexpected authenticated sessions issuing calls to the UpdateTraceLevelSettings method on port 8000.
• Database log entries showing schema enumeration, xp_cmdshell invocation, or queries containing SQL meta-characters originating from the TeleControl Server application user.
• Child processes spawned from the TeleControl Server Basic service running as NT AUTHORITY\NetworkService.
• Outbound network connections initiated by the TeleControl Server Basic service to non-standard destinations.

Detection Strategies

• Inspect application and database logs for malformed parameters or SQL syntax submitted to the UpdateTraceLevelSettings endpoint.
• Hunt for anomalous process creation from the TeleControl Server Basic service account, particularly cmd.exe, powershell.exe, or scripting hosts.
• Correlate authentication events on the TeleControl application with database query patterns that deviate from normal trace-level configuration changes.

Monitoring Recommendations

• Enable verbose logging on the TeleControl Server Basic application and forward logs to a centralized SIEM for query analysis.
• Monitor TCP port 8000 connections and alert on connections from hosts outside the engineering management subnet.
• Track changes to the TeleControl Server database schema and stored procedures, alerting on unexpected DDL operations.

How to Mitigate CVE-2025-32861

Immediate Actions Required

• Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later.
• Restrict network access to TCP port 8000 to a small set of trusted engineering workstations using host or perimeter firewalls.
• Audit existing application accounts and remove or rotate credentials that are no longer required.
• Review the TeleControl database for unauthorized changes and restore from a known-good backup if tampering is detected.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates CVE-2025-32861. See the Siemens Security Advisory SSA-443402 for download links and vendor guidance.

Workarounds

• Limit access to port 8000 to authorized engineering hosts through firewall rules until the patch can be applied.
• Place TeleControl Server Basic systems inside a segmented operational technology (OT) network protected by a jump host with multi-factor authentication.
• Apply the principle of least privilege to all TeleControl application accounts and disable unused accounts.

# Example Windows firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" \
  dir=in action=allow protocol=TCP localport=8000 \
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block" \
  dir=in action=block protocol=TCP localport=8000