CVE-2025-30003: Siemens Telecontrol Server Basic SQLi

CVE-2025-30003 Overview

CVE-2025-30003 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw exists in the internally used UpdateProjectConnections method. An authenticated remote attacker who can reach TCP port 8000 on the host can bypass authorization controls, read and write to the application database, and execute code with NT AUTHORITY\NetworkService permissions. Siemens published advisory SSA-443402 to address the issue, which was reported through the Zero Day Initiative as ZDI-CAN-25910. The vulnerability is tracked under CWE-89 and impacts industrial telecontrol environments used to monitor and control remote stations.

Critical Impact
Authenticated attackers with network access to port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and fully compromise the TeleControl database.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Component: siemens:telecontrol_server_basic
Deployments exposing TCP port 8000 to untrusted networks

Discovery Timeline

2025-04-16 - CVE-2025-30003 published to NVD
2025-08-19 - Last updated in NVD database
Reference - Reported via Zero Day Initiative as ZDI-CAN-25910; addressed by Siemens Security Advisory SSA-443402

Technical Details for CVE-2025-30003

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under [CWE-89]. TeleControl Server Basic exposes the internal UpdateProjectConnections method that accepts attacker-controlled input and concatenates it into a SQL query without proper parameterization. Because the application service runs under the NT AUTHORITY\NetworkService account on Windows, successful injection grants the attacker the same privileges as that service. Attackers can leverage SQL Server features such as xp_cmdshell or stacked queries to escalate from database access to operating system command execution. The flaw also bypasses application-layer authorization, meaning a low-privileged authenticated user can perform actions reserved for administrators.

Root Cause

The root cause is the use of dynamic SQL string concatenation inside the UpdateProjectConnections server-side method instead of parameterized queries or prepared statements. Authorization checks are enforced at a higher layer that the internal method bypasses, so any caller able to reach the method can inject SQL directly into the backing database.

Attack Vector

Exploitation requires network reachability to TCP port 8000 on the affected server and valid authentication credentials. Once authenticated, the attacker invokes the UpdateProjectConnections method with crafted parameters that break out of the intended SQL context. The injected payload can read sensitive project data, modify connection records, or invoke OS-level commands through SQL Server extended procedures. No user interaction is required, and the attack complexity is low.

No verified public proof-of-concept code is available for CVE-2025-30003. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-30003

Indicators of Compromise

Unexpected inbound connections to TCP port 8000 from non-engineering workstations or external networks
Database audit entries showing modifications to project connection tables outside of normal change windows
Process creation events where sqlservr.exe or the TeleControl service spawns cmd.exe, powershell.exe, or other shells under the NetworkService account
Anomalous queries containing SQL meta-characters (', --, ;, xp_cmdshell) in TeleControl application logs

Detection Strategies

Enable SQL Server auditing on the TeleControl database and alert on use of xp_cmdshell, sp_OACreate, or unexpected stored procedure execution
Correlate authentication events to TeleControl Server Basic with subsequent privileged database operations
Inspect application logs for malformed parameters passed to internal methods, particularly UpdateProjectConnections
Apply network detection rules that flag SQL injection patterns in traffic destined to port 8000

Monitoring Recommendations

Monitor child processes of the TeleControl Server Basic service and the SQL Server instance for shell or scripting interpreters
Track outbound network connections initiated by the NetworkService account, which should be minimal in normal operation
Forward Windows Security, Sysmon, and TeleControl application logs to a centralized SIEM for cross-source correlation

How to Mitigate CVE-2025-30003

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens Security Advisory SSA-443402
Restrict TCP port 8000 to trusted engineering hosts using host-based and perimeter firewalls
Audit existing TeleControl user accounts and revoke credentials that are no longer required
Review SQL Server configuration and disable xp_cmdshell unless explicitly needed

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates CVE-2025-30003. The patch is described in advisory SSA-443402. Operators running any version below V3.1.2.2 should plan an upgrade following Siemens' deployment guidance. No alternative vendor fix exists for older branches.

Workarounds

Place TeleControl Server Basic behind a segmented industrial DMZ and block port 8000 from corporate and external networks
Enforce strong, unique authentication for every TeleControl account and apply least privilege to limit blast radius
Run the TeleControl service under a hardened service account with the minimum database permissions required for operation
Apply network access control lists (ACLs) on the SCADA network so only authorized clients reach the server

bash

# Example firewall rule restricting TeleControl port 8000 to a trusted subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Allow-Trusted" \
  dir=in action=allow protocol=TCP localport=8000 \
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block-All" \
  dir=in action=block protocol=TCP localport=8000