Siemens TeleControl Server Basic: 67 records in one advisory

What this batch was researched, not held

16 outside reports led Siemens to search its own code for the same pattern

Trend Micro's Zero Day Initiative reported the first of these to Siemens on 21 February 2025, an injection flaw reachable through the Authenticate method of TeleControl Server Basic, tracked internally as ZDI-CAN-25913 and scored 9.8. Siemens then went looking for the rest itself. Its advisory says the company "conducted a root-cause analysis for potential SQL injection vulnerabilities and has identified the locations in the code base where the underlying legacy design pattern has been used". The result is one advisory covering 67 separate injection findings in a single product, which is why so many of these records read alike. Siemens' advisory says version 3.1.2.2 of that product addresses the identifiers it lists. The United States Cybersecurity and Infrastructure Security Agency republished the set on 22 April 2025 as ICSA-25-112-01, stated plainly that "Siemens reported these vulnerabilities to CISA", and listed by name the 16 identifiers the Zero Day Initiative coordinated, so a reader can count them. The descriptions themselves are the most specific thing in the set, because each one names the method it reaches, such as CreateTrace or Authenticate.

The record you are reading names one method in one product, and 66 others were announced beside it on the same day. Sixteen of the 67 came in from outside and CISA names which sixteen, so you can check whether this one is among them. The rest came out of Siemens reading its own code for one recurring pattern, and each remains its own entry.

Siemens does not mark which 51 of the 67 came from its own review, so the split has to be worked out by subtracting the 16 CISA names. The outside report that started it credits an anonymous researcher rather than a person. Nothing in either advisory says whether any of these was ever used against a real system, and the descriptions name a method without saying which product feature reaches it.

Written from cert-portal.siemens.com, cisa.gov, zerodayinitiative.com. Reviewed for whether every claim traces to one of them, by two independent graders, citation support 4.44 of 5, uniqueness 4 of 5. Stated at high confidence. Nothing in this box is a value the index holds, and none of it opens a receipt.