Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30032
CVE-2025-30032:
Telecontrol Server Basic vulnerability analysis and mitigation
Overview
A SQL injection vulnerability (CVE-2025-30032) was identified in TeleControl Server Basic (versions prior to V3.1.2.2). The vulnerability exists in the internally used 'UpdateDatabaseSettings' method and was discovered on April 16, 2025. The affected software is Siemens TeleControl Server Basic, which is used for remote monitoring and control of plants via WAN/LAN (Siemens Advisory).
Technical details
The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 Base Score of 8.7 (Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The vulnerability specifically affects the 'UpdateDatabaseSettings' method in the application (Siemens Advisory).
Impact
If successfully exploited, this vulnerability allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with 'NT AUTHORITY\NetworkService' permissions. The attack requires the attacker to have access to port 8000 on a system where a vulnerable version of the application is running (Siemens Advisory).
Mitigation and workarounds
Siemens has released version V3.1.2.2 which fixes this vulnerability. As a workaround, organizations are advised to restrict access to port 8000 on affected systems to trusted IP addresses only. Siemens also recommends configuring the environment according to their operational guidelines for Industrial Security (Siemens Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management