CVE-2025-29905: Siemens Telecontrol Server Basic SQLi

CVE-2025-29905 Overview

CVE-2025-29905 is a SQL injection vulnerability [CWE-89] affecting Siemens TeleControl Server Basic in all versions prior to V3.1.2.2. The flaw resides in the internally used RestoreFromBackup method, which fails to properly sanitize input passed to database queries. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application database, and execute code under the NT AUTHORITY\NetworkService account. The vulnerability was reported to Siemens through the Zero Day Initiative under identifier ZDI-CAN-25923.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and fully compromise the TeleControl Server database.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial control environments relying on TeleControl Server Basic for SCADA telecontrol communications

Discovery Timeline

2025-04-16 - CVE-2025-29905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29905

Vulnerability Analysis

CVE-2025-29905 is a SQL injection vulnerability in the RestoreFromBackup method exposed by TeleControl Server Basic. The application accepts attacker-controlled input and concatenates it into database queries without proper parameterization or escaping. Because the method is reachable by any authenticated session, an attacker with low-privileged credentials can escalate impact well beyond the intended authorization boundary.

Successful injection allows the attacker to read arbitrary tables, modify records, and pivot to command execution through database-level features. The server process runs as NT AUTHORITY\NetworkService, giving the attacker network-facing execution context on the underlying Windows host. This provides a pathway into the operational technology (OT) network segment that TeleControl systems typically bridge.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89] within the RestoreFromBackup handler. The method trusts input received over the exposed service on TCP port 8000 and does not apply parameterized queries. Authorization checks that should gate administrative backup operations are also bypassed through the same code path.

Attack Vector

Exploitation requires network reachability to TCP port 8000 and any valid authenticated session against the TeleControl Server Basic service. The attacker submits crafted parameters to the RestoreFromBackup method to inject SQL syntax. Depending on the database engine configuration, the attacker uses stacked queries or extended stored procedures such as xp_cmdshell to execute operating system commands as NT AUTHORITY\NetworkService. No user interaction is required. Refer to the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-29905

Indicators of Compromise

Unexpected inbound connections to TCP port 8000 from hosts outside the engineering workstation subnet
Processes spawned by the TeleControl Server service running as NT AUTHORITY\NetworkService, especially cmd.exe, powershell.exe, or sqlservr.exe child processes
Database audit log entries showing invocations of RestoreFromBackup with anomalous payloads containing SQL metacharacters such as ';, --, or UNION SELECT
New or modified rows in TeleControl configuration tables outside of scheduled maintenance windows

Detection Strategies

Enable SQL Server auditing on the TeleControl database and alert on stored procedure invocations initiated by the service account
Deploy network intrusion detection signatures for SQL injection patterns targeting TCP port 8000
Correlate authentication events on the TeleControl service with subsequent backup or restore operations to identify abuse of low-privileged accounts

Monitoring Recommendations

Baseline legitimate RestoreFromBackup usage and alert on invocations from unexpected client IP addresses
Monitor for NetworkService child process creation using Windows Event ID 4688 with command line auditing enabled
Track outbound connections from the TeleControl host to detect post-exploitation command and control traffic

How to Mitigate CVE-2025-29905

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as specified in Siemens Security Advisory SSA-443402
Restrict access to TCP port 8000 to trusted engineering workstations using host and network firewall rules
Rotate credentials for all TeleControl user accounts, assuming any exposure of authentication material
Review database audit logs for prior invocations of RestoreFromBackup against the vulnerable versions

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate CVE-2025-29905. The fix addresses the SQL injection flaw in the RestoreFromBackup method and restores proper authorization enforcement. Operators should apply the update following Siemens change control guidance and validate telecontrol communications after upgrade. Full remediation details are available in Siemens Security Advisory SSA-443402.

Workarounds

Place TeleControl Server Basic behind a segmented OT firewall that permits port 8000 only from authorized engineering hosts
Enforce network-layer authentication using a jump host or VPN before allowing any client to reach the service
Remove or disable local database features such as xp_cmdshell to limit code execution impact if injection occurs

bash

# Example Windows Firewall rule restricting port 8000 to a trusted subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block" ^
  dir=in action=block protocol=TCP localport=8000