Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4138)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505107);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/05");

  script_cve_id("CVE-2025-4138");
  script_xref(name:"ICSA", value:"26-043-06");

  script_name(english:"Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4138)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Allows the extraction filter to be ignored, allowing symlink targets
to point outside the destination directory, and the modification of
some file metadata.   You are affected by this vulnerability if using
the tarfilemodule to extract untrusted tar archives using
TarFile.extractall()or TarFile.extract()using the
filter=parameter with a value of dataor tar. See the tarfile
extraction filters documentation
https://docs.python.org/3/library/tarfile.html#tarfile-extraction-
filter for more information.  Note that for Python 3.14 or later the
default value of filter=changed from no filtering to `data, so
if you are relying on this new default behavior then your usage is
also affected.  Note that none of these vulnerabilities significantly
affect the installation of source distributions which are tar archives
as source distributions already allow arbitrary code execution during
the build process. However when evaluating source distributions it's
important to avoid installing source distributions with suspicious
links.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-089022.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109997626/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4138");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm324_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm332_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-400_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500wg_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00']},
    "cpe:/o:siemens:scalance_xch328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2EC2']},
    "cpe:/o:siemens:scalance_xcm324_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5324-8TS01-2AC2']},
    "cpe:/o:siemens:scalance_xcm328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2AC2']},
    "cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2ER3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-4AR3']},
    "cpe:/o:siemens:scalance_xcm332_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5332-0GA01-2AC2']},
    "cpe:/o:siemens:scalance_xc-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xc-400_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr-500wg_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr-500_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);