CVE-2025-31351: 
Telecontrol Server Basic vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2025-31351) was identified in TeleControl Server Basic (All versions < V3.1.2.2). The vulnerability exists in the internally used 'CreateProject' method and was discovered and disclosed on April 16, 2025. The affected software is Siemens TeleControl Server Basic, which is used for remote monitoring and control of plants via WAN/LAN (Siemens Advisory).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 8.8 (HIGH) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 Base Score is 8.7 with vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vulnerability specifically affects the 'CreateProject' method in the application (Siemens Advisory).

If exploited, this vulnerability allows an authenticated remote attacker to bypass authorization controls, read from and write to the application's database, and execute code with 'NT AUTHORITY\NetworkService' permissions. The successful exploitation could lead to significant data breaches and system compromise (Siemens Advisory).

Siemens has released version V3.1.2.2 which patches this vulnerability. As a workaround, organizations are advised to restrict access to port 8000 on affected systems to trusted IP addresses only. Siemens also recommends configuring the environment according to their operational guidelines for Industrial Security (Siemens Advisory).