Threat video1:00
CVE-2025-40942 Siemens TeleControl LPE: Detection & IOCs
A local attacker runs code with elevated rights in Siemens TeleControl before V3.1.2.4. 8 IOCs and 9 detection rules, including a free Splunk SPL query.
Read the full threat intel for CVE-2025-40942 Siemens TeleControl LPE: Detection & IOCs →
Chapters
- 0:00The hookPrivilege escalation in Siemens TeleControl Server before V3.1.2.4.
- 0:07The storyReproduced in January on unpatched systems.
- 0:14Attack pathA low-privilege account abuses unnecessary service privileges.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise5 indicators to hunt: 4 URLs and 1 package name.
- 0:39MITRE ATT&CK techniques2 ATT&CK techniques, from initial access to execution.
- 0:44Remediation3 steps now: Update Siemens TeleControl Server Basic.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Privilege escalation in Siemens TeleControl Server before V3.1.2.4.
0:07Reproduced in January on unpatched systems.
0:10Requires local account and unnecessary service privileges.
0:15A low-privilege account abuses unnecessary service privileges.
0:19Then executes arbitrary code with elevated rights.
0:23Unpatched versions before V3.1.2.4 are vulnerable.
0:30No threat actor: this was defensive research.
0:345 indicators to hunt: 4 URLs and 1 package name.
0:392 ATT&CK techniques, from initial access to execution.
0:443 steps now: Update Siemens TeleControl Server Basic.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.