PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32832 Siemens CVE debrief

CVE-2025-32832 is a high-severity SQL injection issue in Siemens TeleControl Server Basic. According to the CISA CSAF advisory and Siemens product security advisory, the flaw is in the internally used LockProjectUserRights method and can let an authenticated remote attacker bypass authorization controls, access the application database for read/write operations, and execute code with NT AUTHORITY\NetworkService permissions. The attack requires network access to port 8000 on a vulnerable system.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

Operators and administrators of Siemens TeleControl Server Basic, especially environments exposing port 8000; OT/ICS security teams; and network defenders responsible for access control and segmentation around the application.

Technical summary

The advisory describes an authenticated SQL injection in TeleControl Server Basic through the internal LockProjectUserRights method. The listed impact is broad: authorization bypass, database read/write access, and remote code execution as NT AUTHORITY\NetworkService. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting remote network reachability, low attack complexity, and high confidentiality/integrity/availability impact. The vendor remediation is to update to V3.1.2.2 or later; CISA also notes that access to port 8000 should be restricted to trusted IP addresses only.

Defensive priority

High. This is an authenticated remote attack path with potential code execution and full database compromise, and it is explicitly network-reachable if port 8000 is exposed. Prioritize patching and exposure reduction.

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Verify that only required users can reach the application and that authentication is enforced and monitored.
  • Review OT/ICS network segmentation to prevent unnecessary exposure of the service.
  • Check application and system logs for unexpected authentication attempts, database activity, or service anomalies after exposure is reduced.

Evidence notes

This debrief is based only on the supplied CISA CSAF advisory ICSA-25-112-01 and the referenced Siemens product security advisory SSA-443402. The CVE and advisory were published on 2025-04-16, and the later 2025-05-06 modification is described as typo fixes only. The supplied source text does not include affected version ranges beyond the remediation target version.

Official resources

Publicly disclosed on 2025-04-16; the source advisory was revised on 2025-05-06 with typo-only changes per the supplied revision history.