CVE-2025-32475
📋 TL;DR
This SQL injection vulnerability in TeleControl Server Basic allows authenticated attackers to bypass authorization, read/write to the database, and execute code with NetworkService permissions. It affects all versions before V3.1.2.2. Attackers need network access to port 8000 on systems running vulnerable versions.
💻 Affected Systems
- TeleControl Server Basic
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with NetworkService privileges leading to lateral movement, data exfiltration, and persistent backdoor installation.
Likely Case
Database manipulation, credential theft, and unauthorized access to industrial control systems data.
If Mitigated
Limited impact due to network segmentation and strict authentication controls preventing access to port 8000.
🎯 Exploit Status
SQL injection through UpdateProject method. Requires authentication but authorization bypass is possible. ZDI-CAN-25912 tracking number suggests coordinated disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.1.2.2
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-443402.html
Restart Required: Yes
Instructions:
1. Download V3.1.2.2 from Siemens official sources. 2. Backup configuration and data. 3. Stop TeleControl Server Basic service. 4. Install the update. 5. Restart the service. 6. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
windowsRestrict access to port 8000/TCP to only trusted management networks
Windows Firewall: New-NetFirewallRule -DisplayName "Block TeleControl Port" -Direction Inbound -LocalPort 8000 -Protocol TCP -Action Block
netsh advfirewall firewall add rule name="Block TeleControl Port" dir=in action=block protocol=TCP localport=8000
Authentication Hardening
allImplement strong authentication and monitor for unusual authentication attempts
🧯 If You Can't Patch
- Implement strict network access controls to port 8000/TCP, allowing only from trusted management stations.
- Deploy web application firewall (WAF) with SQL injection rules in front of the application.
🔍 How to Verify
Check if Vulnerable:
Check TeleControl Server Basic version in application interface or installation directory. Versions below V3.1.2.2 are vulnerable.Check Version:
Check application GUI or installation properties. No standard CLI command available.Verify Fix Applied:
Verify version shows V3.1.2.2 or higher in application interface or about dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts followed by successful login
- Unexpected database modifications
Network Indicators:
- SQL injection patterns in traffic to port 8000
- Unusual outbound connections from TeleControl Server process
SIEM Query:
source="telecontrol_logs" AND ("UpdateProject" OR "SQL" OR "database") AND (status="error" OR status="warning")