Dell Client BIOS Information Disclosure (DSA-2025-299)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253652);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/22");

  script_cve_id("CVE-2025-36581");
  script_xref(name:"IAVA", value:"2025-A-0609");

  script_name(english:"Dell Client BIOS Information Disclosure (DSA-2025-299)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by a vulnerability. Dell 
PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of 
Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading 
to Information exposure.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.dell.com/support/kbdoc/en-us/000356405/dsa-2025-299-security-update-for-dell-poweredge-server-bios-for-an-access-of-memory-location-after-end-of-buffer-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c53e1456");
  script_set_attribute(attribute:"solution", value:
"Update to version 1.26.0 or later");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-36581");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:bios");
  script_set_attribute(attribute:"stig_severity", value:"III");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_idrac_device_detect.nbin");
  script_require_keys("BIOS/Model", "BIOS/Version", "BIOS/Vendor");

  exit(0);
}

include('vcf.inc');
include('hardware_registration.inc');

var hw_info = get_hardware(vendor:'Dell', product:'iDRAC', category:'BMC');

var model = hw_info['extra']['System Model'];
if (empty_or_null(model))
{
  exit(0, 'The model of the device running the Dell BIOS could not be identified.');
}

if (model != 'PowerEdge R6415' && model != 'PowerEdge R7415' && model != 'PowerEdge R7425')
{
  audit(AUDIT_HOST_NOT, 'an affected model');
}

var version = hw_info['extra']['System BIOS Version'];

if (empty_or_null(version) || version == UNKNOWN_VER)
{
  audit(AUDIT_UNKNOWN_APP_VER, 'the Dell BIOS');
}

hw_info.version = version;
hw_info.parsed_version = vcf::parse_version(version);

var fix = '1.26.0';

var constraints = [{ 'fixed_version' : fix, 'fixed_display': fix + ' for ' + model }];
# Have a more useful audit message
hw_info.app = 'Dell System BIOS for ' + model;

vcf::check_version_and_report(app_info:hw_info, constraints:constraints, severity:SECURITY_NOTE);