CVE-2025-30030: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-30030 Overview

CVE-2025-30030 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw exists in the internally used ImportDatabase method, which fails to sanitize input before passing it to database queries [CWE-89]. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and modify the application database, and execute code with NT AUTHORITY\NetworkService permissions. The issue was reported through the Zero Day Initiative as ZDI-CAN-25924 and addressed in Siemens advisory SSA-443402.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with telecontrol database contents.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 to attacker-reachable networks
Industrial control environments relying on TeleControl Server Basic for SCADA telemetry

Discovery Timeline

2025-04-16 - CVE-2025-30030 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30030

Vulnerability Analysis

The vulnerability resides in the ImportDatabase method exposed by TeleControl Server Basic on TCP port 8000. The method concatenates attacker-controlled input into SQL statements without parameterization or sanitization. An authenticated attacker can inject crafted SQL fragments that the backend executes against the application database.

Because ImportDatabase operates with elevated database privileges, the injected SQL bypasses application-layer authorization checks. Successful exploitation grants read and write access to telecontrol data, including configuration tables and operational records. The same primitive enables command execution under the NT AUTHORITY\NetworkService account hosting the service.

The vulnerability requires only low-privileged authentication and no user interaction. Network reachability to port 8000 is the primary precondition. EPSS data places exploitation likelihood at the 46th percentile, reflecting moderate predicted activity but no confirmed in-the-wild use.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. The ImportDatabase routine treats user-supplied data as trusted SQL syntax rather than literal values, allowing query structure to be rewritten by the caller.

Attack Vector

An attacker authenticates to the service over the network, then issues a crafted request to the ImportDatabase endpoint on port 8000. The injected payload pivots from data retrieval to stored procedure abuse, ultimately invoking operating system commands through the database service context. See the Siemens Security Advisory SSA-443402 for protocol-level details.

Detection Methods for CVE-2025-30030

Indicators of Compromise

Unexpected authenticated sessions to TCP port 8000 on TeleControl Server Basic hosts from non-engineering subnets
Process creation events spawning cmd.exe, powershell.exe, or scripting hosts from the TeleControl service under the NetworkService account
New or modified rows in TeleControl databases without a corresponding administrator action in audit logs
Outbound network connections from the TeleControl Server process to unfamiliar destinations

Detection Strategies

Inspect application and database logs for malformed ImportDatabase parameters containing SQL meta-characters such as single quotes, semicolons, or xp_cmdshell references
Alert on child processes of the TeleControl Server Basic service binary, which should not normally spawn shells or interpreters
Correlate authentication events on port 8000 with subsequent database write operations to identify anomalous import activity

Monitoring Recommendations

Enable verbose authentication and request logging on TeleControl Server Basic and forward to a central analytics platform
Monitor network flows to and from port 8000 and baseline normal engineering workstation traffic
Audit database accounts used by the application and alert on privilege use outside scheduled maintenance windows

How to Mitigate CVE-2025-30030

Immediate Actions Required

Upgrade TeleControl Server Basic to version V3.1.2.2 or later as directed in Siemens Advisory SSA-443402
Restrict TCP port 8000 to trusted engineering hosts using host-based and network firewalls
Rotate credentials for all accounts that can authenticate to the TeleControl service, including service accounts
Review database and operating system logs on affected servers for signs of prior exploitation

Patch Information

Siemens addressed CVE-2025-30030 in TeleControl Server Basic V3.1.2.2. Operators should obtain the update from the Siemens Industry Online Support portal and apply it during a planned maintenance window. Validate database integrity and application configuration after upgrading.

Workarounds

Block external access to TCP port 8000 at the perimeter and segment the TeleControl server into a dedicated industrial control zone
Require VPN or jump-host access for any administrative connection to the TeleControl Server Basic instance
Apply the principle of least privilege to the Windows service account running TeleControl Server Basic where supported by the deployment

bash

# Example Windows Firewall rule restricting port 8000 to a management subnet
New-NetFirewallRule -DisplayName "TeleControl-8000-Restrict" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8000 `
  -RemoteAddress 10.10.20.0/24 `
  -Action Allow