CVE-2025-30002: 
Telecontrol Server Basic vulnerability analysis and mitigation

CVE-2025-30002 is a SQL injection vulnerability discovered in Siemens TeleControl Server Basic (versions prior to V3.1.2.2). The vulnerability was disclosed on April 16, 2025, affecting the internally used 'UpdateConnectionVariables' method of the application (Siemens Advisory, CISA Advisory).

The vulnerability exists in the 'UpdateConnectionVariables' method and allows an authenticated remote attacker to perform SQL injection attacks. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and a CVSS v4.0 base score of 8.7 with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (Siemens Advisory).

Successful exploitation of this vulnerability could allow an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with 'NT AUTHORITY\NetworkService' permissions. The attack requires access to port 8000 on a system running a vulnerable version of the application (CISA Advisory).

Siemens has released version V3.1.2.2 which addresses this vulnerability. Organizations are recommended to update to this version or later. Additionally, Siemens recommends restricting access to port 8000 on affected systems to trusted IP addresses only (Siemens Advisory).