PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-27495 Siemens CVE debrief

CVE-2025-27495 is a critical Siemens TeleControl Server Basic issue involving SQL injection in the internally used CreateTrace method. According to the supplied CISA/Siemens advisory material, an unauthenticated remote attacker who can reach port 8000 on a vulnerable system may bypass authorization controls, read and write the database, and execute code as NT AUTHORITY\\NetworkService. Siemens and CISA list an update to V3.1.2.2 or later as the vendor fix, and the advisory also recommends restricting access to port 8000 to trusted IP addresses only.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

Siemens TeleControl Server Basic operators, OT/ICS administrators, network defenders, and any team exposing port 8000 on systems running this product should treat this as urgent.

Technical summary

The advisory describes a SQL injection flaw in the internally used CreateTrace method of Siemens TeleControl Server Basic. The attack path is network reachable and does not require authentication, but it does require access to port 8000 on a system running a vulnerable version. Successful exploitation can bypass authorization controls, enable database read/write access, and lead to code execution with NT AUTHORITY\\NetworkService permissions.

Defensive priority

Critical. The issue is remotely reachable, requires no authentication, and is documented as enabling authorization bypass, database compromise, and code execution. Exposure of port 8000 materially increases risk, so affected deployments should be reviewed and remediated immediately.

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Verify whether any TeleControl Server Basic instances are reachable from untrusted networks and remove unnecessary exposure.
  • Apply OT network segmentation and defense-in-depth controls consistent with CISA ICS recommended practices.
  • Review the Siemens and CISA advisories for product-specific remediation guidance and operational considerations.

Evidence notes

The supplied CISA CSAF advisory for ICSA-25-112-01 states that TeleControl Server Basic is vulnerable to SQL injection via the CreateTrace method, that the attacker must be able to access port 8000, and that the issue can lead to authorization bypass, database read/write access, and code execution as NT AUTHORITY\\NetworkService. The advisory was published on 2025-04-16 and revised on 2025-05-06 for typo fixes only. The supplied enrichment marks the issue as not present in CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-27495 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-27495

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-27495 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-27495

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.