PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32843 Siemens CVE debrief

CVE-2025-32843 affects Siemens TeleControl Server Basic and was publicly disclosed on 2025-04-16, with a later 2025-05-06 revision for typo fixes only. The issue is an SQL injection in the internally used LockUser method. According to the advisory, an authenticated remote attacker who can reach port 8000 on a vulnerable system may bypass authorization controls, read and write the application's database, and execute code as NT AUTHORITY\NetworkService. Siemens recommends updating to V3.1.2.2 or later and restricting access to port 8000 to trusted IP addresses.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

Siemens TeleControl Server Basic administrators, OT/ICS security teams, and network defenders responsible for systems that expose or route access to port 8000.

Technical summary

The supplied CISA CSAF and Siemens advisory describe an SQL injection weakness in the LockUser method of TeleControl Server Basic. Exploitation requires an authenticated remote attacker with access to port 8000 on a vulnerable host. Successful exploitation can bypass authorization controls, enable database read/write access, and lead to code execution under NT AUTHORITY\NetworkService. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, rated 8.8 (High).

Defensive priority

High priority for any exposed TeleControl Server Basic deployment, especially where port 8000 is reachable outside a trusted management network.

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Use network segmentation and allowlisting to keep the service off untrusted networks, following CISA ICS recommended practices.
  • Validate which hosts are running TeleControl Server Basic and confirm they are on a patched version.
  • Monitor for unusual authentication failures, database modification activity, and unexpected process execution on affected systems.

Evidence notes

The source corpus includes CISA's ICS advisory ICSA-25-112-01 and Siemens advisory SSA-443402, both describing the same flaw in TeleControl Server Basic. The advisory text states the vulnerability is an SQL injection through the LockUser method, requires authenticated remote access to port 8000, and can lead to authorization bypass, database read/write, and code execution as NT AUTHORITY\NetworkService. The advisory was published on 2025-04-16 and revised on 2025-05-06 for typo corrections.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-32843 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-32843

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-32843 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32843

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.