CVE-2025-32872: Siemens Telecontrol Server Basic SQLi

CVE-2025-32872 Overview

CVE-2025-32872 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used GetOverview method, which fails to properly sanitize input before constructing SQL statements. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability is tracked under CWE-89 and affects industrial telecontrol environments used to manage remote SCADA stations.

Critical Impact
Authenticated attackers reaching port 8000 can achieve code execution as NT AUTHORITY\NetworkService and full read/write access to the application database.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2

Discovery Timeline

2025-04-16 - CVE-2025-32872 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-32872

Vulnerability Analysis

The vulnerability exists in the GetOverview method exposed by the TeleControl Server Basic application. The method incorporates attacker-controlled input directly into SQL queries without parameterization or sufficient validation. Because the call path is reachable after authentication but bypasses authorization checks downstream, low-privileged accounts can issue queries beyond their intended scope.

Successful exploitation yields three distinct outcomes. First, the attacker can read arbitrary tables in the application database. Second, the attacker can write or modify records that influence application logic and stored credentials. Third, the SQL interface allows execution of operating system commands, granting code execution under the NT AUTHORITY\NetworkService service identity. From this context, attackers can pivot within the operational technology (OT) network, manipulate telecontrol data flows, or stage further intrusion against connected SCADA endpoints.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The GetOverview method concatenates user-supplied parameters into a SQL statement rather than binding them as typed parameters. Authorization controls are also enforced at a layer above the vulnerable query construction, so reaching the method as any authenticated user is sufficient to abuse it.

Attack Vector

Exploitation requires network access to TCP port 8000 on a host running a vulnerable TeleControl Server Basic instance, plus valid authentication credentials. The attacker submits a crafted request that invokes GetOverview with malicious SQL payloads. No user interaction is required. Refer to the Siemens Security Advisory SSA-443402 for protocol-level details.

Detection Methods for CVE-2025-32872

Indicators of Compromise

Unexpected outbound network connections originating from the TeleControl Server Basic process running as NT AUTHORITY\NetworkService.
Anomalous database writes or schema modifications occurring shortly after authenticated sessions to port 8000.
Spawned child processes (cmd.exe, powershell.exe) under the TeleControl Server Basic service account.
Authentication events from low-privileged accounts immediately preceding administrative database queries.

Detection Strategies

Inspect application and database logs for malformed parameters or SQL syntax tokens such as UNION, xp_cmdshell, or stacked queries reaching the GetOverview handler.
Monitor process lineage on hosts running TeleControl Server Basic and alert when the service account spawns interactive shells or scripting engines.
Apply network signatures on traffic to TCP port 8000 looking for SQL metacharacters within authenticated requests.

Monitoring Recommendations

Forward TeleControl Server Basic logs and Windows Security events to a centralized analytics platform with retention sufficient for OT incident review.
Baseline normal GetOverview request patterns and alert on deviations in volume, parameter length, or content.
Track all authentications to port 8000 and correlate with database query volume per session.

How to Mitigate CVE-2025-32872

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later.
Restrict network access to TCP port 8000 to a defined allowlist of engineering workstations and management hosts.
Audit and rotate credentials for all accounts permitted to authenticate to the affected service.
Review database integrity and audit logs for evidence of unauthorized read/write activity since deployment.

Patch Information

Siemens has released V3.1.2.2 of TeleControl Server Basic, which remediates the SQL injection in the GetOverview method. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

Place the TeleControl Server Basic host behind a firewall that limits port 8000 exposure to trusted operator subnets only.
Apply the Siemens operational guidelines for industrial security and segment the OT network from the corporate IT network.
Disable or remove unused authenticated accounts to reduce the pool of credentials usable for exploitation.
Run the service with the least Windows privileges feasible and monitor for any privilege escalation attempts from NT AUTHORITY\NetworkService.

bash

# Example Windows firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="TCSB-Restrict-8000" ^
  dir=in action=block protocol=TCP localport=8000
netsh advfirewall firewall add rule name="TCSB-Allow-Mgmt-8000" ^
  dir=in action=allow protocol=TCP localport=8000 remoteip=10.10.50.0/24