Siemens SIMATIC S7-1200 CPUs Cross-Site Request Forgery (CVE-2024-47100)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502813);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2024-47100");
  script_xref(name:"ICSA", value:"25-021-02");

  script_name(english:"Siemens SIMATIC S7-1200 CPUs Cross-Site Request Forgery (CVE-2024-47100)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The web interface of the affected devices is vulnerable to Cross-Site
Request Forgery (CSRF) attacks. This could allow an unauthenticated
attacker to change the CPU mode by tricking a legitimate and
authenticated user with sufficient permissions on the target CPU to
click on a malicious link.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-717113.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109976907/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has released new versions for the affected products and recommends updating to the latest versions:

- SIMATIC S7-1200 CPU: Update to V4.7 or later version.
- SIPLUS S7-1200 CPU: Update to V4.7 or later version.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- Do not click on links from untrusted sources.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-717113 in HTML and CSAF.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47100");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(352);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/22");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1200_cpu_firmware:4.7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1200_cpu_firmware:4.7");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:siplus_s7-1200_cpu_firmware:4.7" :
        {"versionEndExcluding" : "4.7", "family" : "S71200", "orderNumbers" : ['6AG1215-1HG40-4XB0', '6AG1215-1AG40-5XB0', '6AG1215-1BG40-4XB0', '6AG1214-1AG40-2XB0', '6AG1215-1HG40-5XB0', '6AG1214-1BG40-2XB0', '6AG1214-1HG40-2XB0', '6AG1215-1BG40-5XB0', '6AG1212-1BE40-2XB0', '6AG1215-1BG40-2XB0', '6AG1212-1BE40-4XB0', '6AG1214-1AG40-5XB0', '6AG1215-1AG40-2XB0', '6AG1212-1AE40-2XB0', '6AG1212-1HE40-2XB0', '6AG1214-1HG40-5XB0', '6AG1212-1AE40-4XB0', '6AG1215-1AF40-5XB0', '6AG1214-1HG40-4XB0', '6AG2212-1AE40-1XB0', '6AG1214-1HF40-5XB0', '6AG1215-1AG40-4XB0', '6AG1214-1BG40-5XB0', '6AG1212-1HE40-4XB0', '6AG1215-1HG40-2XB0', '6AG2214-1AG40-1XB0', '6AG1214-1BG40-4XB0', '6AG1214-1AG40-4XB0', '6AG1214-1AF40-5XB0']},
    "cpe:/o:siemens:simatic_s7-1200_cpu_firmware:4.7" :
        {"versionEndExcluding" : "4.7", "family" : "S71200", "orderNumbers" : ['6ES7211-1AE40-0XB0', '6ES7212-1HE40-0XB0', '6ES7212-1AE40-0XB0', '6ES7215-1AF40-0XB0', '6ES7214-1AG40-0XB0', '6ES7211-1BE40-0XB0', '6ES7215-1HG40-0XB0', '6ES7217-1AG40-0XB0', '6ES7215-1HF40-0XB0', '6ES7214-1HF40-0XB0', '6ES7214-1BG40-0XB0', '6ES7215-1AG40-0XB0', '6ES7214-1AF40-0XB0', '6ES7211-1HE40-0XB0', '6ES7212-1AF40-0XB0', '6ES7215-1BG40-0XB0', '6ES7212-1HF40-0XB0', '6ES7214-1HG40-0XB0', '6ES7212-1BE40-0XB0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);