PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32830 Siemens CVE debrief

CVE-2025-32830 is a high-severity SQL injection issue in Siemens TeleControl Server Basic. According to the CISA CSAF advisory, the flaw is reachable through the internally used UnlockProject method and can let an authenticated remote attacker bypass authorization controls, read and write the application's database, and execute code as NT AUTHORITY\NetworkService when the vulnerable service is reachable on port 8000.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

Operators and defenders responsible for Siemens TeleControl Server Basic, especially OT/ICS environments where port 8000 is reachable. Security teams should also pay attention if the product is deployed on Windows systems with broad network access or if authenticated remote users can reach the service.

Technical summary

The advisory describes a SQL injection condition in the internally used UnlockProject method of TeleControl Server Basic. The impact includes authorization bypass, database read/write access, and code execution with NT AUTHORITY\NetworkService permissions. Exploitation requires authenticated remote access and the ability to reach port 8000 on a host running a vulnerable version. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which aligns with a high-severity remote attack path.

Defensive priority

High

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Verify whether any vulnerable instance is reachable from untrusted networks or remote user segments and remove unnecessary exposure.
  • Review affected systems for unexpected database changes or signs of unauthorized authenticated activity if exposure existed.
  • Follow Siemens and CISA ICS defense-in-depth and recommended practices guidance for industrial control system environments.

Evidence notes

All substantive claims here come from the supplied CISA CSAF advisory for ICSA-25-112-01 and its referenced Siemens advisory materials. The advisory text explicitly identifies the UnlockProject SQL injection, the authenticated remote attack requirement, the need to access port 8000, the authorization-bypass and code-execution impacts, and the recommended fix to V3.1.2.2 or later. The revision history shows a 2025-05-06 update marked as typo fixes only.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-32830 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-32830

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-32830 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32830

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.