CVE-2025-31353: Siemens Telecontrol Server Basic SQLi

CVE-2025-31353 Overview

CVE-2025-31353 is a SQL injection vulnerability in Siemens TeleControl Server Basic affecting all versions prior to V3.1.2.2. The flaw resides in the internally used UpdateOpcSettings method and allows authenticated remote attackers to bypass authorization controls. Successful exploitation enables reading from and writing to the application database, as well as executing code with NT AUTHORITY\NetworkService permissions. Exploitation requires network access to TCP port 8000 on a host running the vulnerable application. The vulnerability is tracked as ZDI-CAN-25916 and classified under CWE-89.

Critical Impact
Authenticated attackers with network access to port 8000 can bypass authorization, manipulate the application database, and execute code as NT AUTHORITY\NetworkService.

Affected Products

Siemens TeleControl Server Basic — all versions before V3.1.2.2
Component identifier: siemens:telecontrol_server_basic
CPE: cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*

Discovery Timeline

2025-04-16 - CVE-2025-31353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31353

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the UpdateOpcSettings method used internally by TeleControl Server Basic. The application fails to properly sanitize input passed into SQL statements through this method. An authenticated attacker who can reach the management service on TCP port 8000 can supply crafted parameters that alter the structure of backend SQL queries.

Beyond standard data exposure, the flaw permits authorization bypass. The injected SQL executes within the database context used by the server, and the broader exploitation chain results in arbitrary code execution under the NT AUTHORITY\NetworkService account. This grants attackers a foothold on the Windows host running the telecontrol service, which typically connects to industrial control systems and remote terminal units.

Root Cause

The root cause is improper neutralization of special elements in SQL statements constructed by the UpdateOpcSettings method. User-controlled input is concatenated into queries without parameterized binding or strict input validation, enabling injection of arbitrary SQL syntax.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. The attacker must reach TCP port 8000 on the server hosting TeleControl Server Basic. Once authenticated, the attacker invokes the vulnerable internal method with crafted payloads to trigger SQL injection. Successful execution yields database read/write access and code execution as NetworkService, which is sufficient to pivot deeper into operational technology environments.

No public proof-of-concept code or exploitation in the wild has been reported. Refer to the Siemens Security Advisory SSA-443402 for vendor-supplied technical details.

Detection Methods for CVE-2025-31353

Indicators of Compromise

Unexpected child processes spawned by the TeleControl Server Basic service running under the NT AUTHORITY\NetworkService account.
Anomalous inbound connections to TCP port 8000 from non-engineering workstations or external networks.
Unauthorized modifications to TeleControl database tables related to OPC settings or user authorization records.
Application or database logs containing SQL syntax tokens (UNION, --, ;, xp_cmdshell) in UpdateOpcSettings parameters.

Detection Strategies

Inspect TeleControl Server Basic application logs for malformed input or errors generated by the UpdateOpcSettings handler.
Monitor database audit logs for query patterns inconsistent with the application's normal parameterized statements.
Alert on process creation events where the TeleControl service spawns command interpreters such as cmd.exe or powershell.exe.

Monitoring Recommendations

Capture and review network flow data for TCP port 8000 traffic and restrict it to authorized engineering hosts only.
Enable Windows security auditing for the NetworkService account on TeleControl hosts and forward events to a centralized SIEM.
Baseline normal OPC configuration change frequency and alert on deviations or after-hours modifications.

How to Mitigate CVE-2025-31353

Immediate Actions Required

Upgrade Siemens TeleControl Server Basic to version V3.1.2.2 or later as directed by Siemens Security Advisory SSA-443402.
Restrict network access to TCP port 8000 using host-based and perimeter firewalls so only trusted engineering workstations can reach it.
Audit and rotate credentials for all TeleControl Server Basic accounts following the upgrade.
Review database contents and audit logs for evidence of unauthorized modification prior to patching.

Patch Information

Siemens has released TeleControl Server Basic V3.1.2.2, which remediates CVE-2025-31353. Apply the update on all affected systems. Patch details and download instructions are available in the Siemens ProductCERT advisory SSA-443402.

Workarounds

Segment TeleControl Server Basic systems on a dedicated control network isolated from corporate IT and the internet.
Enforce strict firewall rules limiting TCP port 8000 to known engineering source addresses.
Apply the principle of least privilege to all TeleControl user accounts and disable any unused accounts.
Follow Siemens operational guidelines for securing industrial environments where patching is delayed.

bash

# Example Windows Firewall rule restricting access to port 8000
netsh advfirewall firewall add rule name="Restrict TeleControl 8000" ^
    dir=in action=block protocol=TCP localport=8000

netsh advfirewall firewall add rule name="Allow TeleControl 8000 from engineering" ^
    dir=in action=allow protocol=TCP localport=8000 ^
    remoteip=10.0.10.0/24