PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32835 Siemens CVE debrief

CVE-2025-32835 is a high-severity SQL injection issue in Siemens TeleControl Server Basic, exposed through the internally used UpdateConnectionVariableArchivingBuffering method. According to the advisory, an authenticated remote attacker who can reach port 8000 on a vulnerable host may bypass authorization controls, read and write the application's database, and execute code as NT AUTHORITY\NetworkService. Siemens and CISA published the advisory on 2025-04-16 and later issued a revision on 2025-05-06 for typo fixes.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

OT/ICS administrators, Siemens TeleControl Server Basic operators, defenders responsible for host-based and network segmentation controls, and teams managing authenticated access to systems that expose port 8000.

Technical summary

The supplied advisory describes a SQL injection weakness in the internal UpdateConnectionVariableArchivingBuffering method of Siemens TeleControl Server Basic. The stated impact includes authorization bypass, database read/write access, and code execution with NT AUTHORITY\NetworkService permissions. The attack requires authenticated access and network reachability to port 8000 on a system running a vulnerable version.

Defensive priority

High priority. The combination of authenticated remote access, database compromise, and code execution potential warrants rapid remediation, especially where port 8000 is exposed beyond trusted administrative networks.

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Audit exposed systems for unexpected authentication attempts, database changes, or service activity tied to TeleControl Server Basic.
  • Apply ICS network segmentation and defense-in-depth practices to reduce exposure of management services.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-112-01 (source item) and the Siemens security advisory SSA-443402 referenced in the provided corpus. The advisory text explicitly states the SQL injection condition, the need for authenticated remote access, the port 8000 prerequisite, and the NT AUTHORITY\NetworkService execution context. The 2025-05-06 modification in the supplied timeline is recorded as typo fixes, not a substantive change in the vulnerability description.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-32835 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-32835

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-32835 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32835

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.