CVE-2025-31352: Siemens Telecontrol Server Basic SQLi

CVE-2025-31352 Overview

CVE-2025-31352 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateGateways method and is reachable by authenticated remote attackers with access to TCP port 8000. Successful exploitation allows attackers to bypass authorization controls, read from and write to the application database, and execute code in the context of NT AUTHORITY\NetworkService. The issue was reported to Siemens through the Zero Day Initiative under tracking identifier ZDI-CAN-25915 and is classified under CWE-89.

Critical Impact
Authenticated attackers reaching port 8000 can execute arbitrary code as NT AUTHORITY\NetworkService and manipulate the underlying TeleControl database, exposing industrial control workflows.

Affected Products

Siemens TeleControl Server Basic — all versions prior to V3.1.2.2
Component identifier: siemens:telecontrol_server_basic
CPE: cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*

Discovery Timeline

2025-04-16 - CVE-2025-31352 published to NVD with Siemens advisory SSA-443402
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31352

Vulnerability Analysis

The vulnerability is a classic SQL injection in the server-side UpdateGateways method exposed by TeleControl Server Basic. The method composes SQL statements using attacker-controlled input without parameterization or proper sanitization. Because the method is invoked internally after authentication, the SQL injection becomes a post-authentication primitive on TCP port 8000.

Exploitation gives the attacker direct interaction with the backing database. Beyond reading and writing application data, the injection chain allows code execution under the NT AUTHORITY\NetworkService account, which is the service identity used by the TeleControl Server Basic process on Windows hosts. From that account, an attacker can persist on the system, pivot to other backend services, or tamper with telecontrol configuration data used by downstream SCADA and remote terminal unit (RTU) operations.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The UpdateGateways handler concatenates user-supplied values into a SQL query rather than binding them as parameters. Authorization checks elsewhere in the application are also bypassed because the injected SQL operates directly against the database engine.

Attack Vector

The attack vector is network-based and requires low-privileged authentication. The attacker must reach TCP port 8000 on a host running a vulnerable TeleControl Server Basic instance. After authenticating with any valid account, the attacker invokes the UpdateGateways method with a crafted payload that injects SQL syntax into the constructed statement, achieving database read/write and subsequent code execution as NetworkService.

No verified public proof-of-concept code is available. See the Siemens Security Advisory SSA-443402 for vendor technical details.

Detection Methods for CVE-2025-31352

Indicators of Compromise

Unexpected inbound connections to TCP port 8000 on TeleControl Server Basic hosts from non-engineering workstations.
Anomalous query patterns or new stored procedures in the TeleControl database, particularly insertions or modifications tied to the UpdateGateways workflow.
Child processes spawned by the TeleControl service running as NT AUTHORITY\NetworkService, such as cmd.exe, powershell.exe, or scripting hosts.

Detection Strategies

Inspect TeleControl application logs for malformed or oversized parameters sent to UpdateGateways and for SQL syntax tokens (UNION, --, ;, xp_cmdshell) in request bodies.
Correlate authenticated sessions on port 8000 with database audit logs to surface write operations that originate from the gateway-update code path.
Use endpoint detection telemetry to flag process creation by the TeleControl service account that deviates from a known-good baseline.

Monitoring Recommendations

Enable SQL Server audit logging on the TeleControl database and alert on schema or stored procedure changes.
Capture network flows to and from port 8000 and restrict the source set to authorized engineering subnets.
Monitor for outbound connections from the TeleControl host that follow database write activity, which can indicate post-exploitation staging.

How to Mitigate CVE-2025-31352

Immediate Actions Required

Upgrade TeleControl Server Basic to V3.1.2.2 or later as directed by Siemens advisory SSA-443402.
Restrict TCP port 8000 to trusted engineering hosts using host-based and perimeter firewalls.
Rotate credentials for any account that could authenticate to the TeleControl service, and review database accounts for unauthorized changes.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates the SQL injection in the UpdateGateways method. Patch details and download links are provided in the Siemens Security Advisory SSA-443402.

Workarounds

Limit access to TCP port 8000 to a dedicated management VLAN until the patch is deployed.
Place the TeleControl Server Basic host behind an industrial firewall or jump server that enforces strict authentication and traffic inspection.
Reduce the privileges of accounts permitted to authenticate against the TeleControl service to minimize the exploitation surface.

bash

# Example Windows firewall rule restricting port 8000 to a trusted engineering subnet
netsh advfirewall firewall add rule name="TeleControl-8000-Restrict" ^
    dir=in action=allow protocol=TCP localport=8000 ^
    remoteip=10.20.30.0/24
netsh advfirewall firewall add rule name="TeleControl-8000-BlockAll" ^
    dir=in action=block protocol=TCP localport=8000