Rockwell Automation CompactLogix 5370 Improper Validation of Integrity Check Value (CVE-2025-11694)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505884);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2025-11694");
  script_xref(name:"ICSA", value:"26-167-04");

  script_name(english:"Rockwell Automation CompactLogix 5370 Improper Validation of Integrity Check Value (CVE-2025-11694)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A security issue exists within the affected CompactLogix 5370
controllers due to missing validation of sequence numbers and source
IP addresses in the CIP protocol. An attacker can abuse the exposed
Connection IDs visible on the controller's web interface to send
forged CIP packets, resulting in a minor fault and a denial-of-service
condition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?74a39431");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends users update CompactLogix 5370 L1, L2, and L3 controllers to Version 38.011 or later.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-11694");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(354);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5370_l1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5370_l2_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5370_l3_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:compactlogix_5370_l1_firmware" :
        {"versionEndExcluding" : "38.011", "family" : "CompactLogix5370"},
    "cpe:/o:rockwellautomation:compactlogix_5370_l2_firmware" :
        {"versionEndExcluding" : "38.011", "family" : "CompactLogix5370"},
    "cpe:/o:rockwellautomation:compactlogix_5370_l3_firmware" :
        {"versionEndExcluding" : "38.011", "family" : "CompactLogix5370"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);