Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38084)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505130);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/05");

  script_cve_id("CVE-2025-38084");
  script_xref(name:"ICSA", value:"26-043-06");

  script_name(english:"Siemens SCALANCE and RUGGEDCOM Improper Input Validation (CVE-2025-38084)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb: unshare page tables during VMA split, not before
Currently, __split_vma() triggers hugetlb page table unsharing through
vm_ops->may_split().  This happens before the VMA lock and rmap locks
are taken - which is too early, it allows racing VMA-locked page
faults in our process and racing rmap walks from other processes to
cause page tables to be shared again before we actually perform the
split.  Fix it by explicitly calling into the hugetlb unshare logic
from __split_vma() in the same place where THP splitting also happens.
At that point, both the VMA and the rmap(s) are write-locked.  An
annoying detail is that we can now call into the helper
hugetlb_unshare_pmds() from two different locking contexts:  1. from
hugetlb_split(), holding:     - mmap lock (exclusively)     - VMA lock
- file rmap lock (exclusively) 2. hugetlb_unshare_all_pmds(), which I
think is designed to be able to    call us with only the mmap lock
held (in shared mode), but currently    only runs while holding mmap
lock (exclusively) and VMA lock  Backporting note: This commit fixes a
racy protection that was introduced in commit b30c14cd6102 (hugetlb:
unshare some PMDs when splitting VMAs); that commit claimed to fix an
issue introduced in 5.13, but it should actually also go all the way
back.  [[email protected]: v2]

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-089022.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109997626/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-38084");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm324_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm332_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-400_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500wg_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00']},
    "cpe:/o:siemens:scalance_xch328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2EC2']},
    "cpe:/o:siemens:scalance_xcm324_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5324-8TS01-2AC2']},
    "cpe:/o:siemens:scalance_xcm328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2AC2']},
    "cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2ER3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-4AR3']},
    "cpe:/o:siemens:scalance_xcm332_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5332-0GA01-2AC2']},
    "cpe:/o:siemens:scalance_xc-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xc-400_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr-500wg_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr-500_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);