# Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)

> Siemens SSA-192617 describes a local privilege escalation vulnerability (CWE-250, Execution with Unnecessary Privileges) in TeleControl Server Basic that could allow an attacker to run arbitrary code with elevated privileges. All versions prior to V3.1.2.4 are affected; no active exploitation or public PoC is reported.

- **Published:** 2026-11-07T05:40:16Z
- **Last reviewed:** 2026-11-07T05:40:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5482
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5482.png
- **ID:** TL-2026-5482
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (1 shown free below)
- **CVEs:** CVE-2025-40942

## Description

CVE-2025-40942 is a local privilege escalation vulnerability in Siemens TeleControl Server Basic, a SCADA / telecontrol server product used in industrial control environments. Per Siemens ProductCERT advisory SSA-192617 (published 2026-01-13, version 1.0), all versions prior to V3.1.2.4 are affected, and successful exploitation could allow an attacker to run arbitrary code with elevated privileges. The weakness is classified as CWE-250: Execution with Unnecessary Privileges.

Scoring differs by source. Siemens (CNA) rates the flaw CVSS v3.1 8.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS v4.0 7.3 HIGH (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). NIST NVD's own CVSS v3.1 assessment is 7.8 HIGH with unchanged scope. The attack vector is local (AV:L) and requires low privileges (PR:L), so an attacker must already have an authenticated foothold on the host running TeleControl Server Basic. The vulnerability is not remotely exploitable on its own, but it can serve as a post-compromise step to move from a low-privileged account to full control of the SCADA server.

The advisory does not publish the specific vulnerable component, trigger, or exploit mechanics, and does not report in-the-wild exploitation or a public proof of concept. The issue was reported to Siemens by Peter Cheng of Elex Cybersecurity INC. The fix is to update to V3.1.2.4 or later (Siemens Industry Support entry 109997944). Siemens additionally recommends network access controls and adherence to its operational guidelines for industrial security. No network IOCs (IPs, domains, hashes) are associated with this vulnerability, so no BeaconBeagle C2 correlation applies. CISA's SSVC 2.0.3 assessment recorded in NVD rates Exploitation as none, Automatable as no, and Technical Impact as total, consistent with a high-impact but non-urgent, locally gated flaw. A partial check of the CISA KEV feed did not show the CVE, and the hunt rationale and advisory do not report exploitation.

## MITRE ATT&CK

- T1078.003 Valid Accounts: Local Accounts
- T1078.003 Valid Accounts: Local Accounts
- T1059 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2025-40942 TeleControl Server Basic Spawns Shell/LOLBin — Exploitation** (`TL-2026-5482-SPL-001`)

Fires when a Siemens TeleControl Server Basic process (versions below V3.1.2.4) spawns cmd, PowerShell, script hosts or LOLBins, optionally as SYSTEM. Exploit mechanics are unpublished, so this is the behavioural hunt indicator from the research (SSA-192617). Maps to Exploitation for Privilege Escalation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1068, T1059, T1059.001, T1059.003
- **Data sources:** sysmon
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*TeleControl*" Image IN ("*\\cmd.exe","*\\powershell.exe","*\\pwsh.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe","*\\rundll32.exe","*\\regsvr32.exe","*\\wmic.exe","*\\bitsadmin.exe","*\\certutil.exe")
```Siemens TeleControl Server Basic service process spawning a shell or LOLBin; CVE-2025-40942 LPE hunt```
| eval is_system=if(like(User,"%SYSTEM"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(User) as users values(Image) as children values(CommandLine) as command_lines by host ParentImage is_system
| eval priority=if(is_system=1,"critical - SYSTEM child of TeleControl process","high - interpreter child of TeleControl process")
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFolderPath has "TeleControl" or InitiatingProcessFileName has "TeleControl"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","bitsadmin.exe","certutil.exe")
| project Timestamp, DeviceName, AccountName, AccountDomain, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, ProcessCommandLine, ProcessIntegrityLevel, ProcessTokenElevation
```

### Sigma

```yaml
title: Siemens TeleControl Server Basic Process Spawns Shell or LOLBin (CVE-2025-40942)
id: 5b0e3a52-7d1c-4e0a-9a1f-3c2b6f4d8a01
status: experimental
description: Detects a TeleControl Server Basic process spawning a command interpreter or living-off-the-land binary, the hunt indicator for local privilege escalation via CVE-2025-40942 (SSA-192617).
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-192617.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40942
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/07
tags:
    - attack.privilege_escalation
    - attack.execution
    - attack.t1068
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - cve.2025.40942
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: 'TeleControl'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\wmic.exe'
            - '\bitsadmin.exe'
            - '\certutil.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Siemens-supported maintenance or diagnostic scripts launched by TeleControl services
    - Administrator troubleshooting launched from the TeleControl GUI
level: high

```

**Known false positives:**

- Vendor maintenance scripts invoked by TeleControl services
- Administrators launching a console from the TeleControl application

**Tuning notes:** Replace index=sysmon with your Sysmon index. Confirm real TeleControl process image names on your hosts and narrow ParentImage accordingly; allowlist known vendor scripts by CommandLine. Prioritise hits where is_system=1 on versions below V3.1.2.4.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] SYSTEM Child From User-Writable Path — Exploitation (locked: unlock with TL Creds)
- Local Account Created and Added to Administrators — TeleControl Host Persistence (locked: unlock with TL Creds)
- Admin-Port Lateral Movement From TeleControl Host (locked: unlock with TL Creds)
- TeleControl Directory Binary/DLL Tampering — Exploitation Precursor (locked: unlock with TL Creds)
- Suspicious Service Install — Post-Exploitation Persistence on TeleControl Host (locked: unlock with TL Creds)
- Remote Service Execution Pipes — Lateral Movement From TeleControl Host (locked: unlock with TL Creds)
- Local Account Creation / Admin Add — Post-Exploitation After TeleControl LPE (locked: unlock with TL Creds)
- Interpreter/LOLBin Public Egress From OT Host — C2 After TeleControl LPE (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 8)

Defanged, TLP:CLEAR.

- URL: `hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2025-40942`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Siemens Security Advisory SSA-192617](https://cert-portal.siemens.com/productcert/html/ssa-192617.html)
- [Siemens Industry Support - TeleControl Server Basic update](https://support.industry.siemens.com/cs/ww/en/view/109997944/)
- [NVD - CVE-2025-40942](https://nvd.nist.gov/vuln/detail/CVE-2025-40942)
- [Siemens Operational Guidelines for Industrial Security](https://www.siemens.com/cert/operational-guidelines-industrial-security)
- [SentinelOne Vulnerability Database - CVE-2025-40942](https://www.sentinelone.com/vulnerability-database/cve-2025-40942/)
- [Wiz Vulnerability Database - CVE-2025-40942](https://www.wiz.io/vulnerability-database/cve/cve-2025-40942)
- [Positive Technologies dbugs PT-2026-2353 - Siemens TeleControl Server Basic](https://dbugs.ptsecurity.com/vulnerability/PT-2026-2353)
- [OpenCVE - CVE-2025-40942](https://app.opencve.io/cve/CVE-2025-40942)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5482