Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40250)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505409);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2025-40250");
  script_xref(name:"ICSA", value:"26-188-05");

  script_name(english:"Siemens RUGGEDCOM RST2428P Improper Input Validation (CVE-2025-40250)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Clean up only new IRQ glue on request_irq() failure    The
mlx5_irq_alloc() function can inadvertently free the entire rmap  and
end up in a crash[1] when the other threads tries to access this,
when request_irq() fails due to exhausted IRQ vectors. This commit
modifies the cleanup to remove only the specific IRQ mapping that was
just added.    This prevents removal of other valid mappings and
ensures precise  cleanup of the failed IRQ allocation's associated
glue object.    Note: This error is observed when both fwctl and rds
configs are enabled.    [1]  mlx5_core 0000:05:00.0: Successfully
registered panic handler for port 1  mlx5_core 0000:05:00.0:
mlx5_irq_alloc:293:(pid 66740): Failed to  request irq. err = -28
infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while
trying to test write-combining support  mlx5_core 0000:05:00.0:
Successfully unregistered panic handler for port 1  mlx5_core
0000:06:00.0: Successfully registered panic handler for port 1
mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to
request irq. err = -28  infiniband mlx5_0: mlx5_ib_test_wc:290:(pid
66740): Error -28 while  trying to test write-combining support
mlx5_core 0000:06:00.0: Successfully unregistered panic handler for
port 1  mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed
to  request irq. err = -28  mlx5_core 0000:05:00.0:
mlx5_irq_alloc:293:(pid 28895): Failed to  request irq. err = -28
general protection fault, probably for non-canonical address
0xe277a58fde16f291: 0000 [#1] SMP NOPTI    RIP:
0010:free_irq_cpu_rmap+0x23/0x7d  Call Trace:     <TASK>     ?
show_trace_log_lvl+0x1d6/0x2f9     ? show_trace_log_lvl+0x1d6/0x2f9
? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core]     ?
__die_body.cold+0x8/0xa     ? die_addr+0x39/0x53     ?
exc_general_protection+0x1c4/0x3e9     ? dev_vprintk_emit+0x5f/0x90
? asm_exc_general_protection+0x22/0x27     ?
free_irq_cpu_rmap+0x23/0x7d     mlx5_irq_alloc.cold+0x5d/0xf3
[mlx5_core]     irq_pool_request_vector+0x7d/0x90 [mlx5_core]
mlx5_irq_request+0x2e/0xe0 [mlx5_core]
mlx5_irq_request_vector+0xad/0xf7 [mlx5_core]
comp_irq_request_pci+0x64/0xf0 [mlx5_core]
create_comp_eq+0x71/0x385 [mlx5_core]     ?
mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core]
mlx5_comp_eqn_get+0x72/0x90 [mlx5_core]     ? xas_load+0x8/0x91
mlx5_comp_irqn_get+0x40/0x90 [mlx5_core]
mlx5e_open_channel+0x7d/0x3c7 [mlx5_core]
mlx5e_open_channels+0xad/0x250 [mlx5_core]
mlx5e_open_locked+0x3e/0x110 [mlx5_core]     mlx5e_open+0x23/0x70
[mlx5_core]     __dev_open+0xf1/0x1a5
__dev_change_flags+0x1e1/0x249     dev_change_flags+0x21/0x5c
do_setlink+0x28b/0xcc4     ? __nla_parse+0x22/0x3d     ?
inet6_validate_link_af+0x6b/0x108     ? cpumask_next+0x1f/0x35     ?
__snmp6_fill_stats64.constprop.0+0x66/0x107     ?
__nla_validate_parse+0x48/0x1e6     __rtnl_newlink+0x5ff/0xa57     ?
kmem_cache_alloc_trace+0x164/0x2ce     rtnl_newlink+0x44/0x6e
rtnetlink_rcv_msg+0x2bb/0x362     ? __netlink_sendskb+0x4c/0x6c     ?
netlink_unicast+0x28f/0x2ce     ? rtnl_calcit.isra.0+0x150/0x146
netlink_rcv_skb+0x5f/0x112     netlink_unicast+0x213/0x2ce
netlink_sendmsg+0x24f/0x4d9     __sock_sendmsg+0x65/0x6a
____sys_sendmsg+0x28f/0x2c9     ? import_iovec+0x17/0x2b
___sys_sendmsg+0x97/0xe0     __sys_sendmsg+0x81/0xd8
do_syscall_64+0x35/0x87     entry_SYSCALL_64_after_hwframe+0x6e/0x0
RIP: 0033:0x7fc328603727  Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53
89 fb 48 83 ec 10 e8 0b ed  ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8
2e 00 00 00 0f 05 <48> 3d 00  f0 ff ff 77 35 44 89 c7 48 89 44 24 08
e8 44 ed ff ff 48  RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293
ORIG_RAX: 000000000000002e  RAX: ffffffffffffffda RBX:
000000000000000d RCX: 00007fc328603727  RDX: 0000000000000000 RSI:
00007ffe8eb3f1f0 RDI: 000000000000000d  RBP: 00007ffe8eb3f1f0 R08:
0000000000000000 R09: 0000000000000000  R10: 0000000000000000 R11:
0000000000000293 R12: 0000000000000000  R13: 00000000000
---truncated---

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-253495.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002573/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-188-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40250");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/12/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware" :
        {"family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00'], "versionEndExcluding" : "4.0"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);