Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4517)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505105);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/05");

  script_cve_id("CVE-2025-4517");
  script_xref(name:"ICSA", value:"26-043-06");

  script_name(english:"Siemens SCALANCE and RUGGEDCOM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-4517)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Allows arbitrary filesystem writes outside the extraction directory
during extraction with filter=data.   You are affected by this
vulnerability if using the tarfilemodule to extract untrusted tar
archives using TarFile.extractall()or TarFile.extract()using the
filter=parameter with a value of dataor tar. See the tarfile
extraction filters documentation
https://docs.python.org/3/library/tarfile.html#tarfile-extraction-
filter for more information.  Note that for Python 3.14 or later the
default value of filter=changed from no filtering to `data, so
if you are relying on this new default behavior then your usage is
also affected.  Note that none of these vulnerabilities significantly
affect the installation of source distributions which are tar archives
as source distributions already allow arbitrary code execution during
the build process. However when evaluating source distributions it's
important to avoid installing source distributions with suspicious
links.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-089022.html");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109997626/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4517");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/10");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm324_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm328_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm332_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-300_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xc-400_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500wg_series_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xr-500_series_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "RuggedCom", "orderNumbers" : ['6GK6242-6PA00']},
    "cpe:/o:siemens:scalance_xch328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2EC2']},
    "cpe:/o:siemens:scalance_xcm324_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5324-8TS01-2AC2']},
    "cpe:/o:siemens:scalance_xcm328_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2AC2']},
    "cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2ER3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-5TS01-4AR3']},
    "cpe:/o:siemens:scalance_xcm332_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5332-0GA01-2AC2']},
    "cpe:/o:siemens:scalance_xc-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xr-300_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX300"},
    "cpe:/o:siemens:scalance_xc-400_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX400"},
    "cpe:/o:siemens:scalance_xr-500wg_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"},
    "cpe:/o:siemens:scalance_xr-500_series_firmware" :
        {"versionEndExcluding" : "3.3", "family" : "SCALANCEX500"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);