Schneider Electric Modicon Controllers Externally Controlled Reference to a Resource in Another Sphere (CVE-2025-2875)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503267);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2025-2875");
  script_xref(name:"ICSA", value:"25-140-08");

  script_name(english:"Schneider Electric Modicon Controllers Externally Controlled Reference to a Resource in Another Sphere (CVE-2025-2875)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CWE-610: Externally Controlled Reference to a Resource in Another
Sphere vulnerability exists that could cause a loss of
confidentiality when an unauthenticated attacker manipulates
controller's webserver URL to access resources.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.se.com/us/en/download/document/7EN52-0390/");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-133-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-133-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cc75adc7");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-08");
  script_set_attribute(attribute:"solution", value:
'The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Schneider Electric Modicon Controllers M241/M251 versions prior to 5.3.12.48: Version 5.3.12.48 of Modicon Controllers
M241/M251 includes a fix for this vulnerability and can be downloaded:

- M241: Download here
- M251: Download here
- Use the Controller Assistant feature of EcoStruxure Automation Expert – Motion V24.1 to update the M241/M251 firmware
and perform a reboot.
- EcoStruxure Automation Expert – Motion V24.1 and EcoStruxure Machine Expert V2.3 are available via the Schneider
Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
- Additional information is available in the Quick Start Guide, chapter "EcoStruxure Automation Expert Platform
Installation".

Schneider Electric Modicon Controllers M258/LMC058 versions prior to 5.0.4.19: Modicon M258/LMC058 Firmware version
5.0.4.19 includes a fix for this vulnerabilityand can be downloaded:

- M258: Download here
- LMC058: Download here
- By using Controller Assistant from EcoStruxure Machine Expert update Modicon Controller M258/LMC058 and perform
reboot.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations
to reduce the risk of exploit:

- Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
- Ensure usage of user management and password features. User rights are enabled by default and forced to create a
strong password at first use.
- Deactivate the Webserver after use when not needed.
- Use encrypted communication links when available.
- Setup network segmentation and implement a firewall to block all unauthorized access to ports 80/HTTP and 443/HTTPS.
- Use VPN (Virtual Private Networks) tunnels if remote access is required.
- The "Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated
Equipment" provide product specific hardening guidelines. To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe to Schneider Electric\'s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

The following product versions have been fixed:

- Modicon Controllers M241 version 5.3.12.48 is a fixed version for CVE-2025-2875
- Modicon Controllers M251 version 5.3.12.48 is a fixed version for CVE-2025-2875

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-133-01 Modicon Controllers
M241/M251/M258/LMC058 - SEVD-2025-133-01 PDF Version, Modicon Controllers M241/M251/M258/LMC058 - SEVD-2025-133-01 CSAF
Version.');
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-2875");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m241_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m251_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m258_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_controllers_lmc058_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:modicon_m241_series_firmware" :
        {"versionEndExcluding": "5.3.12.48", "family" : "ModiconM241"},
    "cpe:/o:schneider-electric:modicon_m251_series_firmware" :
        {"versionEndExcluding": "5.3.12.48", "family" : "ModiconM251"},
    "cpe:/o:schneider-electric:modicon_m258_series_firmware" :
        {"family" : "ModiconM258"},
    "cpe:/o:schneider-electric:modicon_controllers_lmc058_firmware" :
        {"family" : "Concept"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);