Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40214)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505448);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2025-40214");
  script_xref(name:"ICSA", value:"26-188-05");

  script_name(english:"Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40214)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
af_unix: Initialise scc_index in unix_add_edge().    Quang Le reported
that the AF_UNIX GC could garbage-collect a  receive queue of an alive
in-flight socket, with a nice repro.    The repro consists of three
stages.      1)      1-a. Create a single cyclic reference with many
sockets      1-b. close() all sockets      1-c. Trigger GC      2)
2-a. Pass sk-A to an embryo sk-B      2-b. Pass sk-X to sk-X      2-c.
Trigger GC      3)      3-a. accept() the embryo sk-B      3-b. Pass
sk-B to sk-C      3-c. close() the in-flight sk-A      3-d. Trigger GC
As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices,  and
unix_walk_scc() groups them into two different SCCs:
unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START)
unix_sk(sk-X)->vertex->scc_index = 3    Once GC completes,
unix_graph_grouped is set to true.  Also, unix_graph_maybe_cyclic is
set to true due to sk-X's  cyclic self-reference, which makes close()
trigger GC.    At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex
and  links it to unix_unvisited_vertices.    unix_update_graph() is
called at 3-a. and 3-b., but neither  unix_graph_grouped nor
unix_graph_maybe_cyclic is changed  because both sk-B's listener and
sk-C are not in-flight.    3-c decrements sk-A's file refcnt to 1.
Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast()  is
finally called and iterates 3 sockets sk-A, sk-B, and sk-X:      sk-A
-> sk-B (-> sk-C)    sk-X -> sk-X    This is totally fine.  All of
them are not yet close()d and  should be grouped into different SCCs.
However, unix_vertex_dead() misjudges that sk-A and sk-B are  in the
same SCC and sk-A is dead.      unix_sk(sk-A)->scc_index ==
unix_sk(sk-B)->scc_index <-- Wrong!    &&    sk-A's file refcnt ==
unix_sk(sk-A)->vertex->out_degree
^-- 1 in-flight count for sk-B    -> sk-A is dead !?    The problem is
that unix_add_edge() does not initialise scc_index.    Stage 1) is
used for heap spraying, making a newly allocated  vertex have
vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START)  set by
unix_walk_scc() at 1-c.    Let's track the max SCC index from the
previous unix_walk_scc()  call and assign the max + 1 to a new
vertex's scc_index.    This way, we can continue to avoid Tarjan's
algorithm while  preventing misjudgments.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002573/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-188-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40214");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware" :
        {"family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00'], "versionEndExcluding" : "4.0"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);