PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-32846 Siemens CVE debrief

CVE-2025-32846 is a high-severity SQL injection vulnerability in Siemens TeleControl Server Basic. The advisory says the issue is in the internally used LockGeneralSettings method and can let an authenticated remote attacker bypass authorization controls, read and write the application database, and execute code as NT AUTHORITY\NetworkService. A successful attack also requires access to port 8000 on a system running a vulnerable version.

Vendor
Siemens
Product
TeleControl Server Basic
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-04-16
Original CVE updated
2025-05-06
Advisory published
2025-04-16
Advisory updated
2025-05-06

Who should care

Siemens TeleControl Server Basic operators, OT/ICS administrators, vulnerability management teams, and defenders responsible for systems exposing port 8000.

Technical summary

CISA’s advisory for Siemens TeleControl Server Basic identifies a SQL injection flaw in the LockGeneralSettings method. The attack path is network-reachable but requires authentication and access to port 8000. If exploited, the attacker may bypass authorization checks, interact with the database for read/write impact, and achieve code execution under the NT AUTHORITY\NetworkService account. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which aligns with the reported 8.8 HIGH severity.

Defensive priority

High

Recommended defensive actions

  • Update Siemens TeleControl Server Basic to V3.1.2.2 or later.
  • Restrict access to port 8000 on affected systems to trusted IP addresses only.
  • Verify which hosts expose port 8000 and review authentication and database activity for unexpected access.
  • Follow the linked CISA ICS recommended practices and defense-in-depth guidance for segmentation and access control.

Evidence notes

The supplied CISA CSAF advisory (ICSA-25-112-01) and Siemens references identify Siemens TeleControl Server Basic as the affected product and describe the SQL injection impact. The CVE was published on 2025-04-16 and the source advisory was revised on 2025-05-06 with a note indicating typo fixes only. The supplied enrichment does not mark this CVE as CISA KEV.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-32846 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-32846

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-32846 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-32846

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-112-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-443402.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-443402.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.