Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2025-69421)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505379);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id("CVE-2025-69421");
  script_xref(name:"ICSA", value:"26-155-04");

  script_name(english:"Hitachi Energy RTU500 NULL Pointer Dereference (CVE-2025-69421)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Processing a malformed PKCS#12 file can trigger a NULL pointer
dereference in the PKCS12_item_decrypt_d2i_ex() function. A NULL
pointer dereference can trigger a crash which leads to Denial of
Service for an application processing PKCS#12 files. The
PKCS12_item_decrypt_d2i_ex() function does not check whether the oct
parameter is NULL before dereferencing it. When called from
PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this
parameter can be NULL, causing Denial of Service impact. The
vulnerability is limited to Denial of Service and cannot be escalated
to achieve code execution or memory disclosure.

Product is affected if a privileged user uploads a malformed PKCS#12
certificate via the web interface or if PKI client functionality is
configured.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentID=8DBD000252&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d21730e8");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-04");
  script_set_attribute(attribute:"solution", value:
"Upgrade the RTU500 series CMU firmware to a fixed version (13.8.2, or
13.7.9 / 12.7.8 depending on the installed branch as listed in the
Hitachi Energy advisory) and apply the general mitigation factors and
workarounds described in the advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-69421");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(476);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.8.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu520_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);