Skip to navigation

Threat reportVulnerabilityTL-2026-5482

Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)

highPATCHED

Siemens SSA-192617 describes a local privilege escalation vulnerability (CWE-250, Execution with Unnecessary Privileges) in TeleControl Server Basic that could allow an attacker to run arbitrary code with elevated privileges. All versions prior to V3.1.2.4 are affected; no active exploitation or public PoC is reported. First disclosed .

Key facts for Siemens TeleControl LPE

IdentifiersTL-2026-5482, CVE-2025-40942
Also known asSSA-192617
SeverityHIGH
CVSS8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
First disclosed
Exploitation statusNo exploitation observed (theoretical)
Affected productsSiemens TeleControl Server Basic
Weaknesses (CWE)CWE-250
MITRE ATT&CK techniquesT1059 Command and Scripting Interpreter, T1078.003 Valid Accounts: Local Accounts
MotivationUNKNOWN
Target sectorsenergy, critical-infrastructure, industrial, utilities
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Siemens TeleControl LPE

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5482 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2025-40942 TeleControl Server Basic Spawns Shell/LOLBin — Exploitation

Fires when a Siemens TeleControl Server Basic process (versions below V3.1.2.4) spawns cmd, PowerShell, script hosts or LOLBins, optionally as SYSTEM. Exploit mechanics are unpublished, so this is the behavioural hunt indicator from the research (SSA-192617). Maps to Exploitation for Privilege Escalation.

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*TeleControl*" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\wmic.exe","*\\bitsadmin.exe","*\\certutil.exe")
```Siemens TeleControl Server Basic service process spawning a shell or LOLBin; CVE-2025-40942 LPE hunt```
| eval is_system=if(like(User,"%SYSTEM"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(User) as users values(Image) as children values(CommandLine) as command_lines by host ParentImage is_system
| eval priority=if(is_system=1,"critical - SYSTEM child of TeleControl process","high - interpreter child of TeleControl process")
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath has "TeleControl" or InitiatingProcessFileName has "TeleControl"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","bitsadmin.exe","certutil.exe")
| project Timestamp, DeviceName, AccountName, AccountDomain, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, ProcessIntegrityLevel, ProcessTokenElevation

Sigma

title: Siemens TeleControl Server Basic Process Spawns Shell or LOLBin (CVE-2025-40942)
id: 5b0e3a52-7d1c-4e0a-9a1f-3c2b6f4d8a01
status: experimental
description: Detects a TeleControl Server Basic process spawning a command interpreter or living-off-the-land binary, the hunt indicator for local privilege escalation via CVE-2025-40942 (SSA-192617).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-192617.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40942
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.privilege_escalation
    - attack.execution
    - attack.t1068
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - cve.2025.40942
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: 'TeleControl'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\wmic.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Siemens-supported maintenance or diagnostic scripts launched by TeleControl services
    - Administrator troubleshooting launched from the TeleControl GUI
level: high

Known false positives:

  • Vendor maintenance scripts invoked by TeleControl services
  • Administrators launching a console from the TeleControl application

Tuning notes: Replace index=sysmon with your Sysmon index. Confirm real TeleControl process image names on your hosts and narrow ParentImage accordingly; allowlist known vendor scripts by CommandLine. Prioritise hits where is_system=1 on versions below V3.1.2.4.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • [indicator] SYSTEM Child From User-Writable Path — Exploitation · unlock with TL Creds
  • Local Account Created and Added to Administrators — TeleControl Host Persistence · unlock with TL Creds
  • Admin-Port Lateral Movement From TeleControl Host · unlock with TL Creds
  • TeleControl Directory Binary/DLL Tampering — Exploitation Precursor · unlock with TL Creds
  • Suspicious Service Install — Post-Exploitation Persistence on TeleControl Host · unlock with TL Creds
  • Remote Service Execution Pipes — Lateral Movement From TeleControl Host · unlock with TL Creds
  • Local Account Creation / Admin Add — Post-Exploitation After TeleControl LPE · unlock with TL Creds
  • Interpreter/LOLBin Public Egress From OT Host — C2 After TeleControl LPE · unlock with TL Creds

Indicators of compromise for Siemens TeleControl LPE

As of 2026-11-07, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5482.

Sample indicators (1 of 8)

  • URL: hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2025-40942

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

8 indicators of compromise · unlock with TL Creds. Compare plans

How Siemens TeleControl LPE works

CVE-2025-40942 is a local privilege escalation vulnerability in Siemens TeleControl Server Basic, a SCADA / telecontrol server product used in industrial control environments. Per Siemens ProductCERT advisory SSA-192617 (published 2026-01-13, version 1.0), all versions prior to V3.1.2.4 are affected, and successful exploitation could allow an attacker to run arbitrary code with elevated privileges. The weakness is classified as CWE-250: Execution with Unnecessary Privileges.

Scoring differs by source. Siemens (CNA) rates the flaw CVSS v3.1 8.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 7.3 HIGH (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). NIST NVD's own CVSS v3.1 assessment is 7.8 HIGH with unchanged scope. The attack vector is local (AV:L) and requires low privileges (PR:L), so an attacker must already have an authenticated foothold on the host running TeleControl Server Basic. The vulnerability is not remotely exploitable on its own, but it can serve as a post-compromise step to move from a low-privileged account to full control of the SCADA server.

The advisory does not publish the specific vulnerable component, trigger, or exploit mechanics, and does not report in-the-wild exploitation or a public proof of concept. The issue was reported to Siemens by Peter Cheng of Elex Cybersecurity INC. The fix is to update to V3.1.2.4 or later (Siemens Industry Support entry 109997944). Siemens additionally recommends network access controls and adherence to its operational guidelines for industrial security. No network IOCs (IPs, domains, hashes) are associated with this vulnerability, so no BeaconBeagle C2 correlation applies. CISA's SSVC 2.0.3 assessment recorded in NVD rates Exploitation as none, Automatable as no, and Technical Impact as total, consistent with a high-impact but non-urgent, locally gated flaw. A partial check of the CISA KEV feed did not show the CVE, and the hunt rationale and advisory do not report exploitation.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078.003 Valid Accounts: Local Accounts

Privilege Escalation

T1078.003 Valid Accounts: Local Accounts

Remediation for Siemens TeleControl LPE

Patches

  • TeleControl Server Basic V3.1.2.4 or later (Siemens Industry Support 109997944)

Immediate actions

  • Update Siemens TeleControl Server Basic to V3.1.2.4 or later
  • Restrict local and interactive logon on TeleControl Server Basic hosts to administrators who need it
  • Implement network access controls to limit access to the TeleControl Server Basic host

Workarounds

  • No specific workaround published; Siemens advises network access controls and operational guidelines for industrial security

Longer-term hardening

  • Follow Siemens operational guidelines for Industrial Security
  • Segment SCADA/OT servers from enterprise IT networks
  • Monitor TeleControl Server Basic hosts for unexpected child processes from its service processes

Affected and fixed versions

  • Siemens — TeleControl Server Basic
    Vulnerable versions: All versions < V3.1.2.4
    Fixed in: V3.1.2.4 or later

Timeline of Siemens TeleControl LPE

  • SSA-192617 remains at version 1.0 with no revisions recorded; it reports no in-the-wild exploitation and no public PoC
  • locked-ioc-8 releases locked-ioc-5 V3.1.2.4 via locked-ioc-8 Industry Support entry 109997944 as the sole remediation; no workaround published
  • locked-ioc-8 credits locked-ioc-7 of locked-ioc-6 for reporting the vulnerability
  • CVE-2025-40942 published to NVD with locked-ioc-8 CVSS v3.1 8.8 and CVSS v4.0 7.3, CWE-250
  • locked-ioc-8 ProductCERT publishes SSA-192617 (v1.0) disclosing CVE-2025-40942 in locked-ioc-5; fix V3.1.2.4 released
  • NVD record modified; NIST assessment of CVSS v3.1 7.8 (scope unchanged) is listed alongside locked-ioc-8' 8.8
  • NVD records latest modification of CVE-2025-40942; record carries CISA SSVC 2.0.3 assessment of Exploitation: none, Automatable: no, Technical Impact: total, and a CPE range of cpe:2.3:a:locked-ioc-8:telecontrol_server_basic versions before 3.1.2.4

Sources cited for Siemens TeleControl LPE

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats