Siemens SCALANCE, SIMATIC S7-1500 Generation of Error Message Containing Sensitive Information (CVE-2018-12886)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(504085);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/05");

  script_cve_id("CVE-2018-12886");
  script_xref(name:"ICSA", value:"23-080-07");

  script_name(english:"Siemens SCALANCE, SIMATIC S7-1500 Generation of Error Message Containing Sensitive Information (CVE-2018-12886)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in
function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under
certain circumstances) generate instruction sequences when targeting
ARM targets that spill the address of the stack protector guard, which
allows an attacker to bypass the protection of -fstack-protector,
-fstack-protector-all, -fstack-protector-strong, and -fstack-
protector-explicit against stack overflow by controlling what the
stack canary is compared against.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-565386.pdf");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-398330.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109815650/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109478459/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-23-080-07");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

For Scalance devices, Siemens recommends updating the software to v2.0 or later. 

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. To operate the devices in a protected IT environment, Siemens recommends users configure the environment
according to Siemens' operational guidelines for Industrial Security and to follow the recommendations in the product
manuals. Additional information on Industrial Security by Siemens can be found on the Siemens webpage for Industrial
Security.

For further inquiries on security vulnerabilities in Siemens products and solutions, users should contact the Siemens
ProductCERT.

For more information, see the associated Siemens security advisory SSA-565386 in HTML and CSAF.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12886");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(209);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/03/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/03/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam763-1_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_%28eu%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_%28us%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_eec_%28eu%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wam766-1_eec_%28us%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum763-1_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum766-1_%28eu%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_wum766-1_%28us%29_firmware:2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:scalance_wam763-1_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5763-1AL00-7DA0']},
    "cpe:/o:siemens:scalance_wam766-1_%28eu%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7DA0']},
    "cpe:/o:siemens:scalance_wam766-1_%28us%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7DB0']},
    "cpe:/o:siemens:scalance_wam766-1_eec_%28eu%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7TA0']},
    "cpe:/o:siemens:scalance_wam766-1_eec_%28us%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-7TB0']},
    "cpe:/o:siemens:scalance_wum763-1_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5763-1AL00-3AA0', '6GK5763-1AL00-3DA0']},
    "cpe:/o:siemens:scalance_wum766-1_%28eu%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-3DA0']},
    "cpe:/o:siemens:scalance_wum766-1_%28us%29_firmware:2.0" :
        {"versionEndExcluding" : "2.0", "family" : "SCALANCEW", "orderNumbers" : ['6GK5766-1GE00-3DB0']},
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AB0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5" :
        {"versionEndExcluding" : "3.1.5", "versionStartIncluding" : "3.1.0", "family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);