CVE-2025-30031 Overview
CVE-2025-30031 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions before V3.1.2.2. The flaw resides in the internally used UpdateUsers method, which fails to sanitize input before incorporating it into database queries [CWE-89].
An authenticated remote attacker with access to port 8000 can bypass authorization controls, read from and write to the application's database, and execute code with NT AUTHORITY\NetworkService permissions. The issue was reported through the Zero Day Initiative as ZDI-CAN-25922.
Critical Impact
Authenticated attackers can execute code as NT AUTHORITY\NetworkService and gain full read/write access to the application database on affected industrial control systems.
Affected Products
- Siemens TeleControl Server Basic (all versions before V3.1.2.2)
- Deployments exposing TCP port 8000 to attacker-reachable networks
- Industrial control environments using TeleControl Server Basic for SCADA telemetry aggregation
Discovery Timeline
- 2025-04-16 - CVE-2025-30031 published to the National Vulnerability Database
- 2025-04-16 - Siemens publishes advisory SSA-443402
- 2025-08-19 - Last updated in NVD database
Technical Details for CVE-2025-30031
Vulnerability Analysis
The vulnerability is a classic SQL injection [CWE-89] in the UpdateUsers method exposed by the TeleControl Server Basic application service. The method is described as "internally used," indicating it was not intended to be reachable by arbitrary authenticated users, but authorization checks can be bypassed through the injection path.
Because the affected code executes inside the TeleControl Server Basic service process, successful exploitation yields command execution under the NT AUTHORITY\NetworkService account. This service identity has sufficient privileges to manipulate application data, pivot to backend SQL Server resources, and persist on the host.
The vulnerability requires network access to TCP port 8000 and a valid set of low-privilege credentials. No user interaction is required.
Root Cause
The UpdateUsers method concatenates attacker-controlled input directly into a SQL statement instead of using parameterized queries or prepared statements. The same code path also lacks an authorization check that would otherwise restrict the method to administrative callers, which is why low-privileged authenticated users can reach it.
Attack Vector
An attacker authenticates to the TeleControl Server Basic application over the network on port 8000. The attacker then invokes the UpdateUsers method with a crafted payload containing SQL metacharacters. The injected SQL executes in the backend database context, enabling arbitrary read and write operations on application tables and, through extended database functionality, command execution as NT AUTHORITY\NetworkService.
The vulnerability manifests in the UpdateUsers handler. No public proof-of-concept is available; see the Siemens Security Advisory SSA-443402 for vendor-provided technical details.
Detection Methods for CVE-2025-30031
Indicators of Compromise
- Unexpected child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService
- Database log entries showing UpdateUsers invocations from non-administrative accounts
- Outbound network connections from the TeleControl host to unfamiliar destinations following authenticated sessions on port 8000
- SQL Server error logs containing syntax exceptions tied to user management procedures
Detection Strategies
- Monitor authentication and method invocation logs for low-privilege accounts calling administrative methods such as UpdateUsers
- Inspect SQL query telemetry for tautologies, stacked queries, or xp_cmdshell invocations originating from the TeleControl application identity
- Alert on process creation chains where the TeleControl service spawns cmd.exe, powershell.exe, or other interpreters
Monitoring Recommendations
- Capture and retain TCP 8000 session metadata to support after-the-fact investigation of authenticated abuse
- Forward Windows Security and Sysmon events from TeleControl hosts to a central SIEM for correlation with database logs
- Baseline normal UpdateUsers calling patterns and alert on deviations in caller identity, frequency, or payload size
How to Mitigate CVE-2025-30031
Immediate Actions Required
- Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens advisory SSA-443402
- Restrict network access to TCP port 8000 to a defined management subnet using host or perimeter firewalls
- Rotate credentials for all TeleControl application accounts, particularly low-privilege users that could be abused for authenticated exploitation
- Audit recent database activity and Windows event logs on TeleControl hosts for signs of prior exploitation
Patch Information
Siemens has released a fixed version in V3.1.2.2. Refer to the Siemens Security Advisory SSA-443402 for download links and deployment guidance. EPSS currently rates the exploitation probability at 0.052%, but the presence of a ZDI submission indicates that proof-of-concept material may be developed by third parties.
Workarounds
- Place TeleControl Server Basic behind a jump host and require VPN access for any session reaching port 8000
- Apply Siemens' defense-in-depth recommendations for industrial environments, including network segmentation between operational technology and corporate networks
- Remove or disable unused application accounts to reduce the set of credentials available for authenticated exploitation
- Run the TeleControl service under the least-privileged account supported by the deployment and revoke unnecessary SQL Server permissions from that identity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
