Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Handling of Exceptional Conditions (CVE-2025-8008)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503330);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2025-8008");
  script_xref(name:"ICSA", value:"25-226-31");

  script_name(english:"Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Handling of Exceptional Conditions (CVE-2025-8008)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A security issue exists in the protected mode of EN4TR devices, where
sending specifically crafted messages during a Forward Close operation
can cause the device to crash.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1739.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3fceaeb5");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-31");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends users upgrade their devices to 7.001 or later. The update can be downloaded from Rockwell
Automation's website.

Rockwell Automation also recommends users follow their published Security Best Practices.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-8008");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(755);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en4tr_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en4trxt_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware" :
        {"versionEndExcluding" : "7.001", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware" :
        {"versionEndExcluding" : "7.001", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware" :
        {"versionEndExcluding" : "7.001", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en4tr_firmware" :
        {"versionEndExcluding" : "7.001", "family" : "ControlLogix"},
    "cpe:/o:rockwellautomation:1756-en4trxt_firmware" :
        {"versionEndExcluding" : "7.001", "family" : "ControlLogix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);