Hitachi Energy RTU500 Integer Overflow or Wraparound (CVE-2026-25210)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505377);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id("CVE-2026-25210");
  script_xref(name:"ICSA", value:"26-155-04");

  script_name(english:"Hitachi Energy RTU500 Integer Overflow or Wraparound (CVE-2026-25210)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In libexpat before 2.7.4, the doContent function does not properly
determine the buffer size bufSize because there is no integer
overflow check for tag buffer reallocation, primarily causing Denial
of Service and potentially confidentiality and integrity impact to
the product.

Product is only affected if IEC 61850 functionality is configured.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://publisher.hitachienergy.com/preview?DocumentID=8DBD000252&LanguageCode=en&DocumentPartId=&Action=Launch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d21730e8");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-04");
  script_set_attribute(attribute:"solution", value:
"Upgrade the RTU500 series CMU firmware to a fixed version (13.8.2, or
13.7.9 / 12.7.8 depending on the installed branch as listed in the
Hitachi Energy advisory) and apply the general mitigation factors and
workarounds described in the advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-25210");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(190);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu520_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu530_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu540_firmware:13.8.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:12.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:hitachienergy:rtu560_firmware:13.8.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/ABB");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/ABB');

var asset = tenable_ot::assets::get(vendor:'ABB');

var vuln_cpes = {
    "cpe:/o:hitachienergy:rtu520_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu520_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu530_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu540_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:12.7" :
        {"versionStartIncluding" : "12.7.1", "versionEndIncluding" : "12.7.7", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.5" :
        {"versionStartIncluding" : "13.5.1", "versionEndIncluding" : "13.5.4", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.6" :
        {"versionStartIncluding" : "13.6.1", "versionEndIncluding" : "13.6.3", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.7" :
        {"versionStartIncluding" : "13.7.1", "versionEndIncluding" : "13.7.8", "family" : "AbbRTU500"},
    "cpe:/o:hitachienergy:rtu560_firmware:13.8.1" :
        {"versionStartIncluding" : "13.8.1", "versionEndIncluding" : "13.8.1", "family" : "AbbRTU500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);