Siemens SIMATIC and SIPLUS products Uncontrolled Resource Consumption (CVE-2025-40944)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505099);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2025-40944");
  script_xref(name:"ICSA", value:"26-015-04");

  script_name(english:"Siemens SIMATIC and SIPLUS products Uncontrolled Resource Consumption (CVE-2025-40944)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Affected devices do not properly handle S7 protocol session disconnect
requests. When receiving a valid S7 protocol Disconnect Request (COTP
DR TPDU) on TCP port 102, the devices enter an improper session state.
This could allow an attacker to cause the device to become
unresponsive, leading to a denial-of-service condition that requires a
power cycle to restore normal operation.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-674753.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109760973/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109769419/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109816000/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109987451/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-015-04");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40944");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200al_im_157-1_pn_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200mp_im_155-5_pn_hf_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_im_155-6_mf_hf_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_im_155-6_pn%2f2_hf_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_im_155-6_pn%2f3_hf_firmware:4.2.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_im_155-6_pn_ha_firmware:1.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_et_200sp_im_155-6_pn_r1_firmware:6.0.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_et_200mp_im_155-5_pn_hf_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_et_200mp_im_155-5_pn_hf_t1_rail_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_t1_rail_firmware:4.2.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_tx_rail_firmware:4.2.0");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_et_200al_im_157-1_pn_firmware" :
        {"family" : "ET200", "orderNumbers" : ['6ES7157-1AB00-0AB0']},
    "cpe:/o:siemens:simatic_et_200mp_im_155-5_pn_hf_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6ES7155-5AA00-0AC0']},
    "cpe:/o:siemens:simatic_et_200sp_im_155-6_mf_hf_firmware" :
        {"family" : "ET200SP", "orderNumbers" : ['6ES7155-6MU00-0CN0']},
    "cpe:/o:siemens:simatic_et_200sp_im_155-6_pn%2f2_hf_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200SP", "orderNumbers" : ['6ES7155-6AU01-0CN0']},
    "cpe:/o:siemens:siplus_et_200mp_im_155-5_pn_hf_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6AG1155-5AA00-7AC0', '6AG1155-5AA00-2AC0']},
    "cpe:/o:siemens:siplus_et_200mp_im_155-5_pn_hf_t1_rail_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6AG2155-5AA00-1AC0']},
    "cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6AG1155-6AU01-2CN0', '6AG1155-6AU01-7CN0']},
    "cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_t1_rail_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6AG2155-6AU01-1CN0']},
    "cpe:/o:siemens:siplus_et_200sp_im_155-6_pn_hf_tx_rail_firmware:4.2.0" :
        {"versionStartIncluding" : "4.2.0", "family" : "ET200", "orderNumbers" : ['6AG2155-6AU01-4CN0']},
    "cpe:/o:siemens:simatic_et_200sp_im_155-6_pn_ha_firmware:1.3" :
        {"versionEndExcluding" : "1.3", "family" : "ET200SP"},
    "cpe:/o:siemens:simatic_et_200sp_im_155-6_pn%2f3_hf_firmware:4.2.2" :
        {"versionEndExcluding" : "4.2.2", "family" : "ET200SP", "orderNumbers" : ['6ES7155-6AU30-0CN0']},
    "cpe:/o:siemens:simatic_et_200sp_im_155-6_pn_r1_firmware:6.0.1" :
        {"versionEndExcluding" : "6.0.1", "family" : "ET200SP", "orderNumbers" : ['6ES7155-6AU00-0HM0']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);