SQL Injection Vulnerability in TeleControl Server Basic by Siemens

CVE-2025-31353

What is CVE-2025-31353?

A vulnerability exists in TeleControl Server Basic versions prior to 3.1.2.2, which is susceptible to SQL injection through the 'UpdateOpcSettings' method. This security flaw allows an authenticated attacker to bypass authorization controls, gaining access to the application's database for reading or writing data, and executing malicious code with permissions associated with 'NT AUTHORITY\NetworkService'. To successfully exploit this vulnerability, an attacker must have access to port 8000 on a system running the vulnerable application.

References