CVE-2025-30032: Siemens Telecontrol Server Basic SQLi

CVE-2025-30032 Overview

CVE-2025-30032 is a SQL injection vulnerability [CWE-89] in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateDatabaseSettings method, which fails to properly sanitize input passed to backend SQL queries. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application database, and execute code with NT AUTHORITY\NetworkService privileges. The vulnerability was reported through the Zero Day Initiative under identifier ZDI-CAN-25921.

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and gain full control of the TeleControl database, compromising industrial telecontrol operations.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2

Discovery Timeline

2025-04-16 - CVE-2025-30032 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-30032

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in the UpdateDatabaseSettings method exposed by TeleControl Server Basic. The method constructs SQL statements using untrusted input without parameterization or adequate validation. Because the method is reachable across the network on port 8000, any authenticated client can inject malicious SQL fragments into queries executed by the backend database engine.

The impact extends beyond data tampering. Successful exploitation grants the attacker the ability to execute operating system commands inheriting the NT AUTHORITY\NetworkService security context of the host process. This allows lateral movement, persistence, and disruption of telecontrol communications between SCADA systems and remote terminal units.

Root Cause

The UpdateDatabaseSettings routine concatenates user-supplied parameters directly into SQL statements. The application also fails to enforce authorization checks before invoking this internal method, so any authenticated session can reach the vulnerable code path regardless of role.

Attack Vector

Exploitation requires network reachability to port 8000 on the host running TeleControl Server Basic and valid authenticated credentials. The attacker submits crafted parameters to the UpdateDatabaseSettings method. The injected SQL is executed by the database engine, enabling arbitrary read and write operations and command execution via database-layer features such as xp_cmdshell or stored procedures running in the service account context.

No public proof-of-concept code is currently available for CVE-2025-30032. Refer to the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-30032

Indicators of Compromise

Unexpected outbound connections or process spawns originating from the TeleControl Server Basic service account NT AUTHORITY\NetworkService.
Unusual writes to TeleControl database tables or modifications to database configuration outside of administrator-initiated change windows.
Authentication events on port 8000 from unfamiliar source addresses or service accounts.
Database engine logs showing malformed or concatenated SQL statements referencing settings update operations.

Detection Strategies

Inspect application and database logs for SQL syntax errors, stacked queries, or comment sequences such as -- and /* appearing in parameters submitted to the settings update endpoint.
Monitor for child processes spawned by the TeleControl service binary, particularly cmd.exe, powershell.exe, or scripting interpreters.
Correlate authenticated session activity on port 8000 with subsequent database writes to identify abuse of legitimate credentials.

Monitoring Recommendations

Enable verbose audit logging on the SQL Server instance backing TeleControl Server Basic and forward logs to a centralized analytics platform.
Baseline normal network traffic to port 8000 and alert on volume spikes, off-hours access, or new source identities.
Track integrity of the TeleControl configuration database with periodic hashing of critical tables and configuration files.

How to Mitigate CVE-2025-30032

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later as directed by Siemens advisory SSA-443402.
Restrict network access to TCP port 8000 so only authorized engineering workstations can reach the service.
Rotate credentials used to authenticate to the TeleControl Server and audit all accounts with access to the management interface.
Review database and Windows event logs since deployment for evidence of prior exploitation.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateDatabaseSettings method. Patch details and download instructions are available in the Siemens Security Advisory SSA-443402.

Workarounds

Place TeleControl Server Basic behind a firewall and limit port 8000 access to a dedicated management VLAN.
Apply Siemens defense-in-depth guidance for industrial control systems and segment OT networks from corporate IT.
Disable or remove unused TeleControl accounts and enforce strong, unique credentials for remaining users.
Restrict the privileges of the database account used by TeleControl so it cannot invoke command execution features such as xp_cmdshell.

bash

# Example: restrict inbound access to TeleControl port 8000 on Windows host
netsh advfirewall firewall add rule name="TeleControl-8000-Allow-MgmtVLAN" \
  dir=in action=allow protocol=TCP localport=8000 \
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl-8000-Block-Other" \
  dir=in action=block protocol=TCP localport=8000