CVE-2025-32862: Siemens Telecontrol Server Basic SQLi

CVE-2025-32862 Overview

CVE-2025-32862 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used LockTraceLevelSettings method, which fails to properly sanitize input before constructing database queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can exploit this weakness to bypass authorization controls, read and write to the application's database, and execute code under the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 to address the issue.

Critical Impact
Authenticated attackers can execute code as NT AUTHORITY\NetworkService and gain full read/write access to the TeleControl Server Basic database via SQL injection.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Component: siemens:telecontrol_server_basic
Network service listening on TCP port 8000

Discovery Timeline

2025-04-16 - CVE-2025-32862 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32862

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. The affected component is the internally used LockTraceLevelSettings method within Siemens TeleControl Server Basic. The method incorporates attacker-controlled input directly into SQL statements without parameterization or sanitization.

Exploitation requires authentication and network reachability to TCP port 8000 on the host running TeleControl Server Basic. Once exploited, attackers bypass the application's authorization model, gaining direct database access. Because the service runs under the NT AUTHORITY\NetworkService Windows account, successful injection results in code execution at that privilege level on the host operating system.

The EPSS score is 0.106%, indicating a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper neutralization of special elements in SQL statements processed by LockTraceLevelSettings. The method concatenates user-supplied parameters into query strings rather than using parameterized queries or prepared statements. This permits attackers to inject arbitrary SQL syntax that modifies query semantics.

Attack Vector

The attack is performed over the network against TCP port 8000. The attacker must hold valid low-privilege credentials to reach the vulnerable internal method. Once authenticated, the attacker submits crafted requests containing SQL metacharacters. The injected payload executes against the backend database, enabling data exfiltration, data tampering, and command execution chained through database functionality running under the service account.

No verified public proof-of-concept code is available. Technical details are described in the Siemens Security Advisory SSA-443402.

Detection Methods for CVE-2025-32862

Indicators of Compromise

Unexpected authenticated sessions to TCP port 8000 on hosts running TeleControl Server Basic
Database query logs containing SQL metacharacters such as ', --, ;, UNION, or xp_cmdshell references tied to the LockTraceLevelSettings call path
Processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService that perform unusual file, registry, or network activity
Modifications to TeleControl Server Basic database tables outside scheduled administrative windows

Detection Strategies

Inspect application and database audit logs for SQL syntax anomalies originating from authenticated client sessions
Correlate authentication events to port 8000 with subsequent child process creation under the service account
Deploy network signatures to flag SQL injection patterns within traffic destined for the TeleControl Server Basic listener

Monitoring Recommendations

Enable verbose database query logging on the backend used by TeleControl Server Basic
Forward Windows process creation events (Event ID 4688) and service account activity to a centralized logging platform
Alert on outbound connections initiated by the TeleControl Server Basic process that deviate from baseline

How to Mitigate CVE-2025-32862

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as directed in advisory SSA-443402
Restrict network access to TCP port 8000 using firewall rules so only trusted operator workstations can reach the service
Rotate credentials for all TeleControl Server Basic accounts following the upgrade
Audit the backend database for unauthorized modifications and unexpected stored procedures

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates CVE-2025-32862. Refer to the Siemens Security Advisory SSA-443402 for download instructions, package hashes, and upgrade guidance.

Workarounds

Limit access to TCP port 8000 to a defined allowlist of management hosts via host-based and perimeter firewalls
Place the TeleControl Server Basic host within a segmented operational technology network zone protected by a demilitarized zone
Enforce strong authentication and minimize the number of accounts authorized to interact with the application
Monitor the NT AUTHORITY\NetworkService account for behavior inconsistent with expected service operation

bash

# Example Windows firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="Restrict TeleControl 8000" ^
  dir=in action=block protocol=TCP localport=8000

netsh advfirewall firewall add rule name="Allow TeleControl 8000 Mgmt" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24