CVE-2025-30002: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-30002 Overview

CVE-2025-30002 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateConnectionVariables method, which fails to properly sanitize input before passing it to the backend database. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application's database, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability is tracked as ZDI-CAN-25909 and is classified under [CWE-89].

Critical Impact
Authenticated attackers with network access to port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and gain full read/write access to the application database.

Affected Products

Siemens TeleControl Server Basic – all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial control environments using TeleControl Server Basic for RTU communication

Discovery Timeline

2025-04-16 - CVE-2025-30002 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-30002

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the UpdateConnectionVariables method of TeleControl Server Basic. The method is used internally by the application to update connection variables in the backing database. Because user-supplied input is concatenated into SQL statements without adequate parameterization, an authenticated attacker can inject arbitrary SQL syntax into the query. Successful exploitation allows the attacker to bypass authorization checks, exfiltrate or modify database contents, and pivot to code execution on the host through database-level features such as xp_cmdshell or stored procedure abuse, running with NT AUTHORITY\NetworkService privileges.

Root Cause

The root cause is improper neutralization of special elements in the SQL command constructed by UpdateConnectionVariables. The application trusts input reaching the internal method and does not enforce prepared statements or strict parameter binding. Authorization checks are also insufficient, allowing low-privilege authenticated users to reach code paths that should be restricted.

Attack Vector

Exploitation requires network access to port 8000 on the host running TeleControl Server Basic and valid application credentials. The attacker sends crafted requests that trigger the vulnerable UpdateConnectionVariables code path. Injected SQL executes in the context of the database service account and, through database engine features, results in operating system command execution as NT AUTHORITY\NetworkService. Refer to the Siemens Security Advisory SSA-443402 for vendor-provided technical detail.

// No verified public proof-of-concept code is available for CVE-2025-30002.
// See Siemens SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-30002

Indicators of Compromise

Unexpected outbound connections or process spawns originating from the TeleControl Server Basic service account (NT AUTHORITY\NetworkService).
Database logs showing malformed SQL, stacked queries, or use of xp_cmdshell associated with the TeleControl Server Basic database.
New or modified rows in TeleControl connection variable tables that do not correspond to legitimate configuration changes.
Authentication events on port 8000 from unexpected source addresses or at unusual times.

Detection Strategies

Monitor traffic to TCP port 8000 on TeleControl Server Basic hosts and alert on requests containing SQL metacharacters or overly long parameter values.
Enable SQL Server auditing on the TeleControl database and flag statements that reference system stored procedures or contain UNION, --, or ; sequences in connection-variable contexts.
Correlate child process creation under the NetworkService account with the TeleControl Server Basic parent process; any shell or scripting host launched from that context warrants investigation.

Monitoring Recommendations

Ingest Windows Security, Sysmon, and SQL Server audit logs into a centralized analytics platform to correlate authentication, query, and process events.
Baseline normal UpdateConnectionVariables traffic patterns and alert on statistical deviations in request frequency, size, or content.
Track application account authentication failures on port 8000 to identify credential-stuffing or brute-force activity that could precede exploitation.

How to Mitigate CVE-2025-30002

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later on all affected hosts.
Restrict network access to TCP port 8000 using host and perimeter firewalls so that only trusted engineering workstations can reach the service.
Rotate credentials for any TeleControl Server Basic accounts that may have been exposed and enforce strong password requirements.
Review database and Windows event logs for signs of prior exploitation before applying the patch.

Patch Information

Siemens has released a fixed build in TeleControl Server Basic V3.1.2.2. Full remediation details, downloads, and additional workarounds are published in the Siemens Security Advisory SSA-443402. Operators should follow Siemens guidance on staging and validation for industrial environments before deploying updates to production RTU communication servers.

Workarounds

Place TeleControl Server Basic on a segmented operational technology network and block port 8000 at network boundaries.
Limit application accounts to the minimum required privileges and remove unused credentials.
Where feasible, run the TeleControl Server Basic service under an account with reduced local privileges and restrict database permissions to prevent OS command execution through the database engine.

bash

# Windows firewall example: restrict port 8000 to a trusted engineering subnet
netsh advfirewall firewall add rule name="TeleControl 8000 Allow Engineering" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl 8000 Block Other" ^
  dir=in action=block protocol=TCP localport=8000