CVE-2025-32865: Siemens Telecontrol Server Basic SQLi

CVE-2025-32865 Overview

CVE-2025-32865 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions before V3.1.2.2. The flaw resides in the internally used CreateLog method. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application database, and execute code in the context of the NT AUTHORITY\NetworkService account. Siemens published advisory SSA-443402 describing the issue and its remediation.

Critical Impact
Authenticated attackers reaching port 8000 can inject SQL through the CreateLog method to manipulate the application database and achieve code execution as NT AUTHORITY\NetworkService.

Affected Products

Siemens TeleControl Server Basic, all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to network-reachable users
Industrial control system (ICS) environments using TeleControl Server Basic for SCADA telemetry

Discovery Timeline

2025-04-16 - CVE-2025-32865 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32865

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the CreateLog method of Siemens TeleControl Server Basic. The method handles log creation requests received over the application's network interface on TCP port 8000. User-supplied input is concatenated into a SQL statement without sufficient parameterization or sanitization. As a result, an authenticated attacker can break out of the intended query context and inject arbitrary SQL syntax.

Because TeleControl Server Basic runs under the NT AUTHORITY\NetworkService Windows account, successful injection extends beyond data manipulation. Attackers can leverage database engine functionality to execute operating system commands inheriting NetworkService privileges. This converts a data-tier vulnerability into a host-level code execution primitive on the Windows server hosting the application.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The CreateLog method constructs database queries by combining trusted SQL fragments with attacker-controllable parameters. Without parameterized statements or input validation, metacharacters such as single quotes and statement terminators alter the intended query structure. The flaw is reachable post-authentication, but the advisory indicates authorization checks themselves can be bypassed through the same injection path.

Attack Vector

Exploitation requires network reachability to port 8000 on the TeleControl Server Basic host and valid application credentials. The attacker submits a crafted request that triggers the CreateLog code path with malicious payloads embedded in log-related fields. The injected SQL is then executed by the backend database with the privileges of the application's service account. Chained with database engine features such as xp_cmdshell or extended stored procedures, the attacker can pivot to operating system command execution as NetworkService, enabling further lateral movement within the OT or IT environment.

No public proof-of-concept exploit code or CISA KEV listing is available at the time of publication.

Detection Methods for CVE-2025-32865

Indicators of Compromise

Unexpected inbound connections to TCP port 8000 on TeleControl Server Basic hosts from non-administrative subnets
Anomalous NT AUTHORITY\NetworkService child processes spawning cmd.exe, powershell.exe, or scripting interpreters
Database audit log entries showing UNION, stacked queries, or system stored procedure calls originating from the TeleControl service account
New or modified rows in the TeleControl application database written outside normal logging workflows

Detection Strategies

Inspect application and SQL Server logs for malformed CreateLog requests containing SQL metacharacters or comment sequences such as --, /*, or ;
Alert on process lineage where the TeleControl Server Basic process tree spawns shell or command interpreters
Monitor for database errors indicating syntax failures consistent with injection probing

Monitoring Recommendations

Forward Windows Security, Sysmon, and database audit logs to a centralized analytics platform for correlation
Track outbound network connections from the NetworkService account, which should rarely initiate external sessions
Baseline normal CreateLog request volumes and content to highlight payload-laden anomalies

How to Mitigate CVE-2025-32865

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens advisory SSA-443402
Restrict TCP port 8000 to authorized engineering workstations using host firewalls and network segmentation
Rotate credentials for application users after patching to invalidate any previously captured authentication material
Review database and Windows event logs for prior exploitation attempts dating back to deployment

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the CreateLog method. Refer to the Siemens Security Advisory SSA-443402 for download links, integrity hashes, and detailed remediation guidance.

Workarounds

Limit network access to port 8000 so only trusted hosts can communicate with the application
Enforce defense-in-depth by placing TeleControl Server Basic behind an ICS-aware firewall and within an isolated OT network zone
Disable or restrict database engine features such as xp_cmdshell that enable OS command execution from SQL contexts
Apply the principle of least privilege to the service account, replacing NetworkService with a dedicated low-privilege identity where supported

bash

# Example: restrict access to TCP port 8000 on the TeleControl Server host
netsh advfirewall firewall add rule name="TeleControl-8000-Allow-EngWS" \
  dir=in action=allow protocol=TCP localport=8000 \
  remoteip=10.10.20.0/24 profile=any

netsh advfirewall firewall add rule name="TeleControl-8000-Block-All" \
  dir=in action=block protocol=TCP localport=8000 profile=any