PatchSiren cyber security CVE debrief

CVE-2025-32839 Siemens CVE debrief

CVE-2025-32839 is a high-severity SQL injection issue in Siemens TeleControl Server Basic. An authenticated remote attacker who can reach port 8000 on a vulnerable system may bypass authorization controls, read and write the application's database, and execute code as NT AUTHORITY\NetworkService.

Vendor: Siemens
Product: TeleControl Server Basic
CVSS: HIGH 8.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-04-16
Original CVE updated: 2025-05-06
Advisory published: 2025-04-16
Advisory updated: 2025-05-06

Who should care

Organizations running Siemens TeleControl Server Basic, especially OT/ICS teams that expose or route traffic to port 8000, should treat this as a high-priority remediation item.

Technical summary

According to the CISA CSAF advisory, the vulnerable behavior is in the internally used GetGateways method. The issue is described as SQL injection with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Successful exploitation requires authenticated access and reachability of port 8000 on the affected host. Impact includes authorization bypass, database read/write access, and code execution under NT AUTHORITY\NetworkService.

Defensive priority

High

Recommended defensive actions

Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
Restrict access to port 8000 on affected systems to trusted IP addresses only.
Review exposed services and network paths to confirm port 8000 is not reachable from untrusted networks.
Validate the affected deployment against Siemens and CISA guidance before returning the system to production.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-112-01 and Siemens product security references provided in the source corpus. The advisory was published on 2025-04-16 and revised on 2025-05-06 for typo fixes. The affected product is Siemens TeleControl Server Basic. The source corpus states that exploitation requires an authenticated remote attacker with access to port 8000.

Sources and references

Verified primary and authoritative sources

CVE-2025-32839 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-32839

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-32839 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32839

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

Reference
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.