Schneider Electric Modicon M340 Controller and Communication Modules Improper Input Validation (CVE-2025-6625)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(504812);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/01");

  script_cve_id("CVE-2025-6625");
  script_xref(name:"ICSA", value:"25-238-03");

  script_name(english:"Schneider Electric Modicon M340 Controller and Communication Modules Improper Input Validation (CVE-2025-6625)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CWE-20: Improper Input Validation vulnerability exists that could
cause a Denial Of Service when specific   crafted FTP command is sent
to the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.se.com/us/en/download/document/7EN52-0390/");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-224-05.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?581bfb75");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-224-05.json
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?168dc6d2");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-238-03");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

- BMXNOE0100 Modbus/TCP Ethernet Modicon M340 module: Version 3.60 of BMXNOE0100 includes a fix for this vulnerability
and is available for download here. Reboot is needed to complete the firmware upgrade.
- BMXNOE0110 Modbus/TCP Ethernet Modicon M340 FactoryCast module: Version 6.80 of BMXNOE0110 includes a fix for this
vulnerability and is available for download here. Reboot is needed to complete the firmware upgrade.

Schneider Electric is establishing a remediation plan for all future versions of Modicon M340, BMXNOR0200H, BMXNGD0100,
and BMXNOC401. Until then, users should immediately apply the following mitigations to reduce the risk of exploit:

- FTP service is disabled by default
- Ensure to disable FTP service when not in use
- Setup network segmentation and implement a firewall to block all unauthorized access to ports 21/FTP
- Use VPN (Virtual Private Networks) tunnels if remote access is required

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2025-224-05.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-6625");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:bmxnoc0401_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:bmxnoe0100_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:bmxnoe0110_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:bmxnor0200h_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:bmxgnd0100_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:modicon_m340_firmware" :
        {"family" : "ModiconM340"},
    "cpe:/o:schneider-electric:bmxnor0200h_firmware" :
        {"family" : "ModiconM340M580CP"},
    "cpe:/o:schneider-electric:bmxgnd0100_firmware" :
        {"family" : "ModiconM340M580CP"},
    "cpe:/o:schneider-electric:bmxnoc0401_firmware" :
        {"family" : "ModiconM340M580CP"},
    "cpe:/o:schneider-electric:bmxnoe0100_firmware" :
        {"versionEndExcluding" : "3.60", "family" : "ModiconM340M580CP"},
    "cpe:/o:schneider-electric:bmxnoe0110_firmware" :
        {"versionEndExcluding" : "6.80", "family" : "ModiconM340M580CP"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);