CVE-2025-31351: Siemens Telecontrol Server Basic SQLi Flaw

CVE-2025-31351 Overview

CVE-2025-31351 is a SQL injection vulnerability affecting Siemens TeleControl Server Basic versions prior to V3.1.2.2. The flaw resides in the internally used CreateProject method, which fails to properly sanitize user-supplied input before constructing database queries. An authenticated remote attacker with access to TCP port 8000 can exploit this issue to bypass authorization controls, read and modify database contents, and execute code under the NT AUTHORITY\NetworkService account. The issue was reported through the Zero Day Initiative as ZDI-CAN-25917 and is tracked under CWE-89.

Critical Impact
Authenticated attackers with network access to port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and tamper with the application database.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Deployments exposing TCP port 8000 to untrusted networks
Industrial control system environments using TeleControl Server Basic for SCADA telecontrol

Discovery Timeline

2025-04-16 - CVE-2025-31351 published to NVD
2025-08-19 - Last updated in NVD database

Technical Details for CVE-2025-31351

Vulnerability Analysis

The vulnerability is a classic server-side SQL injection. The CreateProject method, used internally by the TeleControl Server Basic application, concatenates attacker-controlled parameters into SQL statements without parameterization. Because the method is reachable over the network on port 8000, any authenticated user can pass crafted input that alters query semantics.

Successful exploitation grants the attacker the ability to read and write arbitrary records in the application database. Because the database connection runs in the context of the host service account, an attacker can chain SQL injection with stacked queries or stored procedures, such as xp_cmdshell on Microsoft SQL Server, to execute operating system commands as NT AUTHORITY\NetworkService. This elevates the impact from a data integrity issue to remote code execution on the host.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The CreateProject method does not apply prepared statements, parameter binding, or input allowlisting before passing values to the database engine. Authorization enforcement is performed only at higher application layers, so injected SQL bypasses business-logic access controls entirely.

Attack Vector

The attack vector is network-based and requires low-privilege authenticated access. The attacker must reach the TeleControl Server Basic service on port 8000 and submit a request that invokes the vulnerable CreateProject flow with malicious payloads inside project metadata fields. Refer to the Siemens Security Advisory SSA-443402 for protocol-level details.

No public proof-of-concept code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-31351

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running under NT AUTHORITY\NetworkService.
Database audit log entries showing unusual CREATE, INSERT, or EXEC statements originating from the application service account.
Outbound network connections from the TeleControl host to unknown external addresses following project-creation activity.
New or modified projects appearing in the TeleControl database without a matching legitimate user session.

Detection Strategies

Inspect application and database logs for SQL syntax errors or batched statements correlated with calls to the CreateProject operation.
Monitor port 8000 traffic for anomalous payloads containing SQL meta-characters such as single quotes, semicolons, and comment sequences.
Enable database server auditing for stored-procedure execution, particularly any procedure capable of invoking the operating system shell.

Monitoring Recommendations

Forward Windows process creation events (Event ID 4688) from the TeleControl host to a centralized log platform for correlation.
Alert on authentication events to TeleControl Server Basic followed within seconds by database write operations from the same session.
Baseline normal CreateProject request volume and content so that injection-style payloads stand out for analyst review.

How to Mitigate CVE-2025-31351

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to V3.1.2.2 or later, as directed in the Siemens Security Advisory SSA-443402.
Restrict network access to TCP port 8000 so that only trusted engineering workstations can reach the service.
Audit existing TeleControl user accounts and revoke credentials that are no longer required, reducing the pool of authenticated attackers.
Review the application database for unauthorized objects, accounts, or stored procedures that may have been introduced before patching.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2 to remediate the SQL injection in the CreateProject method. Customers should apply this update through standard Siemens distribution channels. Full advisory text and download references are available in Siemens Security Advisory SSA-443402.

Workarounds

Place TeleControl Server Basic behind a firewall and limit inbound port 8000 traffic to a defined allowlist of engineering hosts.
Segment the operational technology network from corporate and internet-facing networks to reduce reachability for remote attackers.
Run the TeleControl service with the least-privileged account permitted by the deployment, and remove unnecessary database privileges such as the ability to execute shell commands.
Increase logging verbosity on the TeleControl service and database engine until the patch is deployed, enabling faster identification of exploitation attempts.

bash

# Example Windows Firewall rule restricting port 8000 to a trusted subnet
netsh advfirewall firewall add rule name="TeleControl 8000 Allowlist" ^
  dir=in action=allow protocol=TCP localport=8000 ^
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="TeleControl 8000 Block" ^
  dir=in action=block protocol=TCP localport=8000