Siemens PROFINET Stack Integrated on Interniche Stack Uncontrolled Resource Consumption (CVE-2022-25622)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500641);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2022-25622");

  script_name(english:"Siemens PROFINET Stack Integrated on Interniche Stack Uncontrolled Resource Consumption (CVE-2022-25622)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been identified in SIMATIC CFU DIQ (All versions),
SIMATIC CFU PA (All versions), SIMATIC S7-1500 CPU family (incl.
related ET200 CPUs and SIPLUS variants) (All versions < V2.0.0),
SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS
variants) (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS
variants) (All versions < V6.0.10), SIMATIC S7-400 PN/DP V7 CPU family
(incl. SIPLUS variants) (All versions), SIMATIC S7-410 V10 CPU family
(incl. SIPLUS variants) (All versions), SIMATIC S7-410 V8 CPU family
(incl. SIPLUS variants) (All versions), SIMATIC TDC CP51M1 (All
versions), SIMATIC TDC CPU555 (All versions), SIMATIC WinAC RTX (All
versions), SIMIT Simulation Platform (All versions). The PROFINET
(PNIO) stack, when integrated with the Interniche IP stack, improperly
handles internal resources for TCP segments where the minimum TCP-
Header length is less than defined. This could allow an attacker to
create a denial of service condition for TCP services on affected
devices by sending specially crafted TCP segments.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-446448.pdf");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-06");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens recommends the following workarounds and mitigations users can apply to reduce risk:

- SIMATIC ET 200pro IM154-8 PN/DP CPU, SIMATIC ET 200pro IM154-8F PN/DP CPU, SIMATIC ET 200pro IM154-8FX PN/DP CPU,
SIMATIC ET 200S IM151-8 PN/DP CPU, SIMATIC ET 200S IM151-8F PN/DP CPU: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 314C-2 PN/DP: Update to V3.3.19 or later version
- SIMATIC S7-300 CPU 315-2 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 315F-2 PN/DP: Update to V3.2.19 or later version 
- SIMATIC S7-300 CPU 315T-3 PN/DP: Update to V3.2.19 or later version 
- SIMATIC S7-300 CPU 317-2 PN/DP, SIMATIC S7-300 CPU 317F-2 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 317T-3 PN/DP: Update to V3.2.19 or later version 
- SIMATIC S7-300 CPU 317TF-3 PN/DP: Update to V3.2.19 or later version 
- SIMATIC S7-300 CPU 319-3 PN/DP: Update to V3.2.19 or later version 
- SIMATIC S7-300 CPU 319F-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants): Update to v6.0.10 or later version.
- SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants): Update to V8.2.3 or later version. 

- SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants): Update to V10.1.1 or later version. 

- SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): Update to V2.0.0 or later version. 

- SIMATIC TDC CP51M1: Update to V1.1.10 or later version
- SIMATIC TDC CPU555: Update to V1.2.1 or later version 

- SIPLUS ET 200S IM151-8 PN/DP CPU: Update to V3.2.19 or later version
- SIPLUS ET 200S IM151-8F PN/DP CPU: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 314C-2 PN/DP: Update to V3.3.19 or later version
- SIPLUS S7-300 CPU 315-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 315F-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 317-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 317F-2 PN/DP: Update to V3.2.19 or later version

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

- Limit access to Port 102/TCP to trusted users and systems only.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate
mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the
environment according to Siemens' operational guidelines for industrial security and to follow the recommendations in
the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens.

For additional information, please refer to Siemens Security Advisory SSA-446448 - PDF Version, SSA-446448 – TXT
Version, or SSA-446448 – CSAF Version.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-25622");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/04/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-300_cpu_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-400h_v6_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-400_pn%2fdp_v7_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_tdc_cp51m1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_tdc_cpu555_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-300_cpu_firmware" :
        {"versionEndExcluding" : "3.2.19", "family" : "S7300"},
    "cpe:/o:siemens:simatic_s7-400h_v6_firmware" :
        {"versionStartIncluding" : "6.0", "versionEndExcluding" : "6.0.10", "family" : "S7400"},
    "cpe:/o:siemens:simatic_s7-400_pn%2fdp_v7_firmware" :
        {"versionStartIncluding" : "7.0", "versionEndIncluding" : "7.x", "family" : "S7400"},
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware" :
        {"versionEndExcluding" : "2.0.0", "family" : "S71500"},
    "cpe:/o:siemens:simatic_tdc_cp51m1_firmware" :
        {"versionEndExcluding" : "1.1.10", "family" : "TDCCP51m1"},
    "cpe:/o:siemens:simatic_tdc_cpu555_firmware" :
        {"versionEndExcluding" : "1.2.1", "family" : "TDCCPU555"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);