Siemens SIMATIC S7-1500 Improper Following of Specification by Caller (CVE-2025-39770)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505156);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2025-39770");
  script_xref(name:"ICSA", value:"26-134-10");

  script_name(english:"Siemens SIMATIC S7-1500 Improper Following of Specification by Caller (CVE-2025-39770)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
net: gso: Forbid IPv6 TSO with extensions on devices with only
IPV6_CSUM    When performing Generic Segmentation Offload (GSO) on an
IPv6 packet that  contains extension headers, the kernel incorrectly
requests checksum offload  if the egress device only advertises
NETIF_F_IPV6_CSUM feature, which has  a strict contract: it supports
checksum offload only for plain TCP or UDP  over IPv6 and explicitly
does not support packets with extension headers.  The current GSO
logic violates this contract by failing to disable the feature  for
packets with extension headers, such as those used in GREoIPv6
tunnels.    This violation results in the device being asked to
perform an operation  it cannot support, leading to a
`skb_warn_bad_offload` warning and a collapse  of network throughput.
While device TSO/USO is correctly bypassed in favor  of software GSO
for these packets, the GSO stack must be explicitly told not  to
request checksum offload.    Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and
NETIF_F_GSO_UDP_L4  in gso_features_check if the IPv6 header contains
extension headers to compute  checksum in software.    The exception
is a BIG TCP extension, which, as stated in commit  68e068cabd2c6c53
(net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets):  The
feature is only enabled on devices that support BIG TCP TSO.  The
header is only present for PF_PACKET taps like tcpdump,  and not
transmitted by physical devices.    kernel log output (truncated):
WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535
skb_warn_bad_offload+0x81/0x140  ...  Call Trace:   <TASK>
skb_checksum_help+0x12a/0x1f0   validate_xmit_skb+0x1a3/0x2d0
validate_xmit_skb_list+0x4f/0x80   sch_direct_xmit+0x1a2/0x380
__dev_xmit_skb+0x242/0x670   __dev_queue_xmit+0x3fc/0x7f0
ip6_finish_output2+0x25e/0x5d0   ip6_finish_output+0x1fc/0x3f0
ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]   ip6gre_tunnel_xmit+0x1c0/0x390
[ip6_gre]   dev_hard_start_xmit+0x63/0x1c0
__dev_queue_xmit+0x6d0/0x7f0   ip6_finish_output2+0x214/0x5d0
ip6_finish_output+0x1fc/0x3f0   ip6_xmit+0x2ca/0x6f0
ip6_finish_output+0x1fc/0x3f0   ip6_xmit+0x2ca/0x6f0
inet6_csk_xmit+0xeb/0x150   __tcp_transmit_skb+0x555/0xa80
tcp_write_xmit+0x32a/0xe90   tcp_sendmsg_locked+0x437/0x1110
tcp_sendmsg+0x2f/0x50  ...  skb linear:   00000000: e4 3d 1a 7d ec 30
e4 3d 1a 7e 5d 90 86 dd 60 0e  skb linear:   00000010: 00 0a 1b 34 3c
40 20 11 00 00 00 00 00 00 00 00  skb linear:   00000020: 00 00 00 00
00 12 20 11 00 00 00 00 00 00 00 00  skb linear:   00000030: 00 00 00
00 00 11 2f 00 04 01 04 01 01 00 00 00  skb linear:   00000040: 86 dd
60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00  skb linear:   00000050: 00
00 00 00 00 00 00 00 00 12 20 23 00 00 00 00  skb linear:   00000060:
00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9  skb linear:
00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01  skb linear:
00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-082556.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-134-10");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-39770");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(573);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_cpu_firmware:3.1.5" :
        {"versionStartIncluding" : "3.1.5", "family" : "S71500", "orderNumbers" : ['6ES7518-4AX00-1AB0', '6ES7518-4FX00-1AC0', '6ES7518-4AX00-1AC0', '6ES7518-4FX00-1AB0']},
    "cpe:/o:siemens:siplus_s7-1500_cpu_firmware:3.1.5" :
        {"versionStartIncluding" : "3.1.5", "family" : "S71500", "orderNumbers" : ['6AG1518-4AX00-4AC0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);