CVE-2025-32872: 
Telecontrol Server Basic vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2025-32872) has been identified in TeleControl Server Basic (versions prior to V3.1.2.2). The vulnerability exists in the internally used 'GetOverview' method, affecting the application's database access functionality. This vulnerability was disclosed on April 16, 2025, and impacts all versions of TeleControl Server Basic before V3.1.2.2 (Siemens Advisory).

The vulnerability is classified as a SQL injection (CWE-89) that affects the 'GetOverview' method. It has received a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 base score of 8.7 (Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The vulnerability requires access to port 8000 on systems running vulnerable versions of the application (NVD, Siemens Advisory).

Successful exploitation of this vulnerability could allow an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with 'NT AUTHORITY\NetworkService' permissions. This could potentially lead to unauthorized data access, data manipulation, and limited code execution on the affected system (Siemens Advisory).

Siemens has released version V3.1.2.2 which addresses this vulnerability. Organizations are recommended to update to this version or later. As a temporary workaround, Siemens recommends restricting access to port 8000 on affected systems to trusted IP addresses only. Additionally, organizations should follow Siemens' operational guidelines for Industrial Security (Siemens Advisory).