CVE-2025-31350: Siemens Telecontrol Server Basic SQLi

CVE-2025-31350 Overview

CVE-2025-31350 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateBufferingSettings method. An authenticated remote attacker with access to TCP port 8000 can bypass authorization controls, read and write to the application's database, and execute code under the NT AUTHORITY\NetworkService account. The issue was reported through the Zero Day Initiative as ZDI-CAN-25918 and is classified under [CWE-89].

Critical Impact
Authenticated attackers can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with the underlying database used by industrial telecontrol operations.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial control environments relying on TeleControl Server Basic for SCADA buffering and aggregation

Discovery Timeline

2025-04-16 - CVE-2025-31350 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31350

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements in SQL statements within the UpdateBufferingSettings method. This method is reachable through the network service on TCP port 8000. An authenticated attacker can inject crafted SQL fragments into parameters processed by the method, which the application concatenates into a query executed by the backend database engine.

Because the database service runs with NT AUTHORITY\NetworkService privileges and supports stacked queries or extended procedures, the injection extends beyond data tampering. Attackers can pivot from arbitrary SQL execution to operating system command execution on the host. The flaw also allows attackers to bypass authorization checks normally enforced by the application layer, since the affected method is described as "internally used" yet remains exposed to authenticated clients.

Root Cause

The root cause is missing parameterization in the UpdateBufferingSettings handler. Input received from the network is incorporated directly into SQL queries without binding or sanitization, which is the canonical pattern described by [CWE-89]. The internal nature of the method led to an implicit trust assumption that was not enforced at the protocol boundary.

Attack Vector

Exploitation requires network access to port 8000 on a host running a vulnerable TeleControl Server Basic instance and a valid set of low-privilege application credentials. Once authenticated, the attacker invokes the UpdateBufferingSettings method with malicious SQL payloads in its parameters. Successful exploitation yields read and write access to the application database and code execution in the context of the service account. See the Siemens Security Advisory SSA-443402 for technical details.

Detection Methods for CVE-2025-31350

Indicators of Compromise

Unexpected inbound sessions to TCP port 8000 from hosts outside the engineering subnet
New or modified rows in the TeleControl Server Basic database that were not produced by authorized operator actions
Child processes spawned by the TeleControl service running under NT AUTHORITY\NetworkService
Outbound network connections initiated by the TeleControl service to non-allowlisted destinations

Detection Strategies

Inspect application and database logs for queries originating from UpdateBufferingSettings that contain SQL meta-characters such as ;, --, or xp_ prefixes
Alert on authentication events to TeleControl Server Basic followed by anomalous database write volume
Baseline normal command-line activity for the TeleControl service and flag deviations such as cmd.exe or powershell.exe spawned by the service

Monitoring Recommendations

Forward Windows process creation events (Event ID 4688) and Sysmon Event ID 1 for the TeleControl service host to a central log platform
Capture netflow for TCP 8000 and correlate sources with the authorized engineering workstation inventory
Enable database auditing for schema changes, stored procedure execution, and privileged operations on the TeleControl database

How to Mitigate CVE-2025-31350

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed in Siemens Security Advisory SSA-443402
Restrict TCP port 8000 to a minimum set of trusted management hosts using host firewalls or network ACLs
Rotate credentials for all TeleControl Server Basic application accounts after patching
Audit the TeleControl database for unauthorized rows, stored procedures, or schema changes

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateBufferingSettings method. Refer to Siemens Security Advisory SSA-443402 for the authoritative download location and verification details.

Workarounds

Block external access to TCP port 8000 and only permit connections from a dedicated engineering jump host
Place TeleControl Server Basic behind a segmented industrial DMZ in line with IEC 62443 zone and conduit guidance
Disable or remove application accounts that are not required for current operational workflows to reduce the authenticated attack surface

bash

# Example Windows firewall rule restricting port 8000 to a trusted host
netsh advfirewall firewall add rule name="TeleControl 8000 Restrict" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.5 profile=any

netsh advfirewall firewall add rule name="TeleControl 8000 Block Other" ^
  dir=in action=block protocol=TCP localport=8000