Siemens SCALANCE and RUGGEDCOM Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2025-40569)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505103);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/01");

  script_cve_id("CVE-2025-40569");
  script_xref(name:"ICSA", value:"25-162-04");

  script_name(english:"Siemens SCALANCE and RUGGEDCOM Concurrent Execution Using Shared Resource with Improper Synchronization (CVE-2025-40569)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Load Configuration from Local PC functionality in the web
interface of affected products contains a race condition
vulnerability. This could allow an authenticated remote attacker to
make the affected product load an attacker controlled configuration
instead of the legitimate one. Successful exploitation requires that a
legitimate administrator invokes the functionality and the attacker
wins the race condition.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-693776.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109988839/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- RUGGEDCOM RST2428P (6GK6242-6PA00), SCALANCE XC316-8 (6GK5324-8TS00-2AC2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2),
SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2), SCALANCE XC332 (6GK5332-0GA00-2AC2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2),
SCALANCE XC424-4 (6GK5428-4TR00-2AC2), SCALANCE XC432 (6GK5432-0GR00-2AC2), SCALANCE XCH328 (6GK5328-4TS01-2EC2),
SCALANCE XCM324 (6GK5324-8TS01-2AC2), SCALANCE XCM328 (6GK5328-4TS01-2AC2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3),
SCALANCE XR302-32 (6GK5334-5TS00-3AR3), SCALANCE XR302-32 (6GK5334-5TS00-4AR3), SCALANCE XR322-12 (6GK5334-3TS00-2AR3),
SCALANCE XR322-12 (6GK5334-3TS00-3AR3), SCALANCE XR322-12 (6GK5334-3TS00-4AR3), SCALANCE XR326-8 (6GK5334-2TS00-2AR3),
SCALANCE XR326-8 (6GK5334-2TS00-3AR3), SCALANCE XR326-8 (6GK5334-2TS00-4AR3), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3),
SCALANCE XR502-32 (6GK5534-5TR00-2AR3), SCALANCE XR502-32 (6GK5534-5TR00-3AR3), SCALANCE XR502-32 (6GK5534-5TR00-4AR3),
SCALANCE XR522-12 (6GK5534-3TR00-2AR3), SCALANCE XR522-12 (6GK5534-3TR00-3AR3), SCALANCE XR522-12 (6GK5534-3TR00-4AR3),
SCALANCE XR526-8 (6GK5534-2TR00-2AR3), SCALANCE XR526-8 (6GK5534-2TR00-3AR3), SCALANCE XR526-8 (6GK5534-2TR00-4AR3),
SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3),
SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)
(6GK5334-5TS01-4AR3), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3), SCALANCE XRM334 (24 V DC, 12xFO)
(6GK5334-3TS01-2AR3), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3), SCALANCE XRM334 (230 V AC,
8xFO) (6GK5334-2TS01-3AR3), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3), SCALANCE XRM334 (230V AC, 2x10G,
24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3): Update to V3.2 or later version
- SCALANCE XCM332 (6GK5332-0GA01-2AC2): Update to V3.2 or later version

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-693776 in HTML and CSAF.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40569");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(362);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch328_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm324_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm328_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm332_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00']},
    "cpe:/o:siemens:scalance_xch328_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2EC2']},
    "cpe:/o:siemens:scalance_xcm324_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5324-8TS01-2AC2']},
    "cpe:/o:siemens:scalance_xcm328_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2AC2']},
    "cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2ER3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.2" :
        {"versionEndExcluding" : "3.2", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-4AR3']},
    "cpe:/o:siemens:scalance_xcm332_firmware" :
        {"family" : "SCALANCEX300", "orderNumbers" : ['6GK5332-0GA01-2AC2']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);