CVE-2025-32837 Siemens CVE debrief

Who should care

Organizations running Siemens TeleControl Server Basic, especially OT and industrial environments where port 8000 is reachable from non-trusted networks. Security teams, asset owners, and operators responsible for network segmentation, remote access control, and patch management should prioritize this advisory.

Technical summary

The advisory describes an SQL injection in the internally used GetActiveConnectionVariables method. The issue is reachable over the network and requires attacker authentication plus access to port 8000 on a vulnerable system. Successful exploitation can lead to authorization bypass, database read/write access, and code execution under NT AUTHORITY\NetworkService. The advisory assigns CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Defensive priority

High. The combination of network reachability, authenticated exploitation, and potential code execution in an OT-related product makes this a priority fix, particularly where port 8000 is exposed beyond tightly controlled administrative networks.

Recommended defensive actions

• Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
• Restrict access to port 8000 on affected systems to trusted IP addresses only.
• Review network segmentation and remote access paths to ensure the service is not broadly reachable.
• Validate whether any systems are running affected versions and inventory them for expedited remediation.
• Monitor for unexpected database activity or service behavior on exposed instances while remediation is underway.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-112-01 and Siemens product advisory references supplied in the corpus. The source text explicitly states the vulnerability is an SQL injection in GetActiveConnectionVariables, that exploitation requires authenticated remote access to port 8000, and that impact includes authorization bypass, database read/write, and code execution as NT AUTHORITY\NetworkService. The advisory also provides the mitigation to restrict port 8000 and the vendor fix version V3.1.2.2 or later. No KEV listing is provided in the supplied data.

Official resources