SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-30030

Summary

A security vulnerability has been discovered in TeleControl Server Basic, affecting all versions prior to V3.1.2.2. This flaw allows an authenticated remote user to exploit the 'ImportDatabase' method through SQL injection, potentially bypassing authorization controls. The attacker could gain unauthorized access to read and write data to the application's database and execute code with elevated privileges under 'NT AUTHORITY\NetworkService'. Successful exploitation necessitates access to port 8000 on the affected system.

References