Rockwell Automation Stratix Managed Switches Cross-site Request Forgery to Code Execution (CVE-2025-7350)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503329);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2025-7350");
  script_xref(name:"ICSA", value:"25-252-03");

  script_name(english:"Rockwell Automation Stratix Managed Switches Cross-site Request Forgery to Code Execution (CVE-2025-7350)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A security issue affecting multiple Cisco devices also directly 
impacts Stratix 5410, 5700, and 8000 devices. This can lead to 
remote code execution by uploading and running malicious configurations 
without authentication. 

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2025-7350");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1745.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?64951469");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation has provided an update that mitigates this vulnerability. Users are recommended to update to version
15.2(8)E6 or later.

If users are not able to upgrade to the corrected version, Rockwell Automation recommends referring to their security
best practices.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-7350");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(74);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5400_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5410_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_5700_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:rockwellautomation:allen-bradley_stratix_8000_industrial_managed_ethernet_switch");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/h:rockwellautomation:allen-bradley_stratix_5400_industrial_managed_ethernet_switch" :
        {"versionEndIncluding" : "15.2(8)E5", "family" : "Stratix"},
    "cpe:/h:rockwellautomation:allen-bradley_stratix_5410_industrial_managed_ethernet_switch" :
        {"versionEndIncluding" : "15.2(8)E5", "family" : "Stratix"},
    "cpe:/h:rockwellautomation:allen-bradley_stratix_5700_industrial_managed_ethernet_switch" :
        {"versionEndIncluding" : "15.2(8)E5", "family" : "Stratix"},
    "cpe:/h:rockwellautomation:allen-bradley_stratix_8000_industrial_managed_ethernet_switch" :
        {"versionEndIncluding" : "15.2(8)E5", "family" : "Stratix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);