Siemens SIPROTEC 5 Devices Use of Default Credentials (CVE-2024-54015)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502863);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2024-54015");
  script_xref(name:"ICSA", value:"25-044-05");

  script_name(english:"Siemens SIPROTEC 5 Devices Use of Default Credentials (CVE-2024-54015)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Affected devices do not properly validate SNMP GET requests. This
could allow an unauthenticated, remote attacker to retrieve sensitive
information of the affected devices with SNMPv2 GET requests using
default credentials.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-767615.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-05");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- All affected products: Restrict access to port 161/udp to trusted IP addresses only.
- All affected products: Disable the SNMP service running in the communication modules, if not used.
- SIPROTEC 5 7KE85 (CP300), SIPROTEC 5 7ST85 (CP300), SIPROTEC 5 7ST86 (CP300): Currently no fix is available.
- SIPROTEC 5 Compact 7SX800 (CP050): Update to V9.90 or later version.
- SIPROTEC 5 7SA82 (CP150), SIPROTEC 5 7SD82 (CP150), SIPROTEC 5 7SJ81 (CP150), SIPROTEC 5 7SJ82 (CP150), SIPROTEC 5
7SK82 (CP150), SIPROTEC 5 7SL82 (CP150), SIPROTEC 5 7SX82 (CP150), SIPROTEC 5 7SY82 (CP150), SIPROTEC 5 7UT82 (CP150):
Update to V9.90 or later version.
- SIPROTEC 5 6MD84 (CP300), SIPROTEC 5 6MD85 (CP300), SIPROTEC 5 6MD86 (CP300), SIPROTEC 5 6MD89 (CP300), SIPROTEC 5
6MU85 (CP300), SIPROTEC 5 7SA86 (CP300), SIPROTEC 5 7SA87 (CP300), SIPROTEC 5 7SD86 (CP300), SIPROTEC 5 7SD87 (CP300),
SIPROTEC 5 7SJ85 (CP300), SIPROTEC 5 7SJ86 (CP300), SIPROTEC 5 7SK85 (CP300), SIPROTEC 5 7SL86 (CP300), SIPROTEC 5 7SL87
(CP300), SIPROTEC 5 7SS85 (CP300), SIPROTEC 5 7SX85 (CP300), SIPROTEC 5 7UM85 (CP300), SIPROTEC 5 7UT85 (CP300),
SIPROTEC 5 7UT86 (CP300), SIPROTEC 5 7UT87 (CP300), SIPROTEC 5 7VE85 (CP300), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85
(CP300): Update to V9.90 or later version.
- SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2), SIPROTEC 5
Communication Module ETH-BD-2FO: Update to V9.90 or later version.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-767615 in HTML and CSAF.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-54015");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(1392);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/02/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/20");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md84_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md89_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6mu85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ke85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj81_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ss85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7st85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7st86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sx82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sx85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sy82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7um85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ve85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7vk87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7vu85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_compact_7sx800_%28cp050%29_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:siprotec_5_7ke85_%28cp300%29_firmware" :
        {"versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7st85_%28cp300%29_firmware" :
        {"versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7st86_%28cp300%29_firmware" :
        {"family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_compact_7sx800_%28cp050%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "9.50", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj81_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sk82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sx82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sy82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md84_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md89_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6mu85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sk85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ss85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sx85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7um85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ve85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7vk87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "versionStartIncluding" : "8.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7vu85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "9.90", "family" : "Siprotec5"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);