Siemens Ruggedcom Rox Improper Neutralization of Argument Delimiters in a Command (CVE-2025-40948)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505469);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id("CVE-2025-40948");

  script_name(english:"Siemens Ruggedcom Rox Improper Neutralization of Argument Delimiters in a Command (CVE-2025-40948)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Affected devices do not properly validate input in the web server's
JSON-RPC interface.    This could allow an authenticated remote
attacker to read arbitrary files from the underlying operating
system's filesystem with root privileges.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-973901.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/110002017/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-40948");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(88);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_mx5000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_mx5000re_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1400_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1500_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1501_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1510_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1511_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1512_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1524_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx1536_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rox_rx5000_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rox_mx5000_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_mx5000re_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1400_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1500_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1501_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1510_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1511_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1512_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1524_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx1536_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"},
    "cpe:/o:siemens:ruggedcom_rox_rx5000_firmware" :
        {"versionEndExcluding" : "2.17.1", "family" : "RuggedCom"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);