CVE-2025-31349: Siemens Telecontrol Server Basic SQLi

CVE-2025-31349 Overview

CVE-2025-31349 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateSmtpSettings method, which fails to properly sanitize input before constructing database queries. An authenticated remote attacker with access to port 8000 can bypass authorization controls, read and write to the application's database, and execute code under the NT AUTHORITY\NetworkService account. The issue was reported through the Zero Day Initiative as ZDI-CAN-25919 and is tracked under [CWE-89].

Critical Impact

Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and gain full read/write access to the TeleControl database.

Affected Products

• Siemens TeleControl Server Basic (all versions before V3.1.2.2)
• Deployments exposing TCP port 8000 to untrusted networks
• Industrial environments using TeleControl Server Basic for SCADA telecontrol communications

Discovery Timeline

• 2025-04-16 - CVE-2025-31349 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-31349

Vulnerability Analysis

The vulnerability is a SQL injection flaw categorized under [CWE-89]. It exists in the UpdateSmtpSettings method, which is exposed through the application's internal interface listening on TCP port 8000. The method incorporates attacker-controlled values into SQL statements without adequate parameterization or escaping.

Because TeleControl Server Basic runs as a Windows service under the NT AUTHORITY\NetworkService account, successful injection grants the attacker the privileges of that service account. The injection can be leveraged beyond data exfiltration to achieve code execution, likely through stacked queries or database-level features such as xp_cmdshell if enabled.

The attacker must first authenticate to the application, but the flaw allows bypass of subsequent authorization controls. This elevates the impact beyond a typical low-privilege user scenario.

Root Cause

The UpdateSmtpSettings method concatenates user-supplied SMTP configuration values directly into SQL query strings instead of using parameterized statements. The application also fails to enforce authorization checks on this internal method, allowing any authenticated user to invoke it regardless of their assigned role.

Attack Vector

The attack is conducted remotely over the network. An attacker who can reach TCP port 8000 on the target server and possesses valid credentials sends a crafted request invoking the UpdateSmtpSettings method. The injected SQL payload executes within the database context and can pivot to operating system command execution as NT AUTHORITY\NetworkService. Refer to the Siemens Security Advisory SSA-443402 for protocol-level details.

Detection Methods for CVE-2025-31349

Indicators of Compromise

• Unexpected child processes spawned by the TeleControl Server Basic service running as NT AUTHORITY\NetworkService
• Anomalous SQL statements in application or database logs referencing the UpdateSmtpSettings operation
• New or modified database records in SMTP configuration tables outside of normal administrative windows
• Outbound network connections initiated by the TeleControl service to unfamiliar hosts

Detection Strategies

• Inspect network traffic to TCP port 8000 for malformed or oversized parameters targeting the UpdateSmtpSettings method
• Enable verbose SQL auditing on the backend database to capture suspicious query patterns such as stacked statements, xp_cmdshell invocations, or UNION SELECT payloads
• Correlate authentication events with subsequent administrative method calls to surface privilege bypass attempts

Monitoring Recommendations

• Forward TeleControl Server Basic application logs and Windows Security event logs to a centralized SIEM for correlation
• Alert on process creation events where NT AUTHORITY\NetworkService spawns cmd.exe, powershell.exe, or other interpreters
• Monitor for changes to SMTP-related configuration entries that do not match a corresponding administrator action

How to Mitigate CVE-2025-31349

Immediate Actions Required

• Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed by Siemens
• Restrict access to TCP port 8000 to trusted management hosts using host-based or network firewalls
• Rotate credentials for all accounts that can authenticate to the application following any suspected exposure
• Review database audit logs for evidence of prior injection attempts against the UpdateSmtpSettings method

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateSmtpSettings method. Apply the update following the guidance in the Siemens Security Advisory SSA-443402.

Workarounds

• Place TeleControl Server Basic behind a segmented operational technology network with strict firewall rules limiting access to port 8000
• Restrict application accounts to the minimum required users and enforce strong, unique credentials
• Follow Siemens operational guidelines for industrial security and apply defense-in-depth controls around exposed control systems

# Example Windows firewall rule restricting port 8000 to a management subnet
netsh advfirewall firewall add rule name="TeleControl 8000 Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.0.10.0/24
netsh advfirewall firewall add rule name="TeleControl 8000 Block All" ^
  dir=in action=block protocol=TCP localport=8000