Siemens SIPROTEC 5 Allocation of Resources Without Limits or Throttling (CVE-2025-40570)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(504808);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/12");

  script_cve_id("CVE-2025-40570");
  script_xref(name:"ICSA", value:"25-226-10");

  script_name(english:"Siemens SIPROTEC 5 Allocation of Resources Without Limits or Throttling (CVE-2025-40570)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Affected devices do not properly limit the bandwidth for incoming
network packets over their local USB port. This could allow an
attacker with physical access to send specially crafted packets with
high bandwidth to the affected devices thus forcing them to exhaust
their memory and stop responding to any network traffic via the local
USB port. Affected devices reset themselves automatically after a
successful attack. The protection function is not affected of this
vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-894058.html");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-10");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109757433/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109796884/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109814150/");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- SIPROTEC 5 6MD84 (CP300), SIPROTEC 5 6MD85 (CP300), SIPROTEC 5 6MD86 (CP300), SIPROTEC 5 6MD89 (CP300), SIPROTEC 5
6MU85 (CP300), SIPROTEC 5 7KE85 (CP300), SIPROTEC 5 7SA86 (CP300), SIPROTEC 5 7SA87 (CP300), SIPROTEC 5 7SD86 (CP300),
SIPROTEC 5 7SD87 (CP300), SIPROTEC 5 7SJ85 (CP300), SIPROTEC 5 7SJ86 (CP300), SIPROTEC 5 7SK85 (CP300), SIPROTEC 5 7SL86
(CP300), SIPROTEC 5 7SL87 (CP300), SIPROTEC 5 7SS85 (CP300), SIPROTEC 5 7ST85 (CP300), SIPROTEC 5 7ST86 (CP300),
SIPROTEC 5 7SX85 (CP300), SIPROTEC 5 7UM85 (CP300), SIPROTEC 5 7UT85 (CP300), SIPROTEC 5 7UT86 (CP300), SIPROTEC 5 7UT87
(CP300), SIPROTEC 5 7VE85 (CP300), SIPROTEC 5 7VK87 (CP300), SIPROTEC 5 7VU85 (CP300): Update to V10.0 or later version
- SIPROTEC 5 7SA82 (CP150), SIPROTEC 5 7SD82 (CP150), SIPROTEC 5 7SJ81 (CP150), SIPROTEC 5 7SJ82 (CP150), SIPROTEC 5
7SK82 (CP150), SIPROTEC 5 7SL82 (CP150), SIPROTEC 5 7SX82 (CP150), SIPROTEC 5 7SY82 (CP150), SIPROTEC 5 7UT82 (CP150):
Update to V10.0 or later version
- SIPROTEC 5 Compact 7SX800 (CP050): Update to V10.0 or later version

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-894058 in HTML and CSAF.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40570");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md84_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6md89_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_6mu85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ke85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sa87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sd87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj81_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sj86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sk85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sl87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ss85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7st85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7st86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sx82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sx85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7sy82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7um85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut82_%28cp150%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut86_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ut87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7ve85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7vk87_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_7vu85_%28cp300%29_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siprotec_5_compact_7sx800_%28cp050%29_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:siprotec_5_6md84_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6md89_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_6mu85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ke85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sk85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ss85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7st85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7st86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sx85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7um85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut86_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ve85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7vk87_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "versionStartIncluding" : "7.80", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7vu85_%28cp300%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sa82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sd82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj81_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sj82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sk82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sl82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sx82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7sy82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_7ut82_%28cp150%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"},
    "cpe:/o:siemens:siprotec_5_compact_7sx800_%28cp050%29_firmware" :
        {"versionEndExcluding" : "10.0", "family" : "Siprotec5"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_NOTE);