Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2025-69419)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505144);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/16");

  script_cve_id("CVE-2025-69419");

  script_name(english:"Siemens SIMATIC S7-1500 Out-of-bounds Write (CVE-2025-69419)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Issue summary: Calling PKCS12_get_friendlyname() function on a
maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly
name containing non-ASCII BMP code point can trigger a one byte write
before the allocated buffer.  Impact summary: The out-of-bounds write
can cause a memory corruption which can have various consequences
including a Denial of Service.  The OPENSSL_uni2utf8() function
performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to
UTF-8. In the second pass, when emitting UTF-8 bytes, the helper
function bmp_to_utf8() incorrectly forwards the remaining UTF-16
source byte count as the destination buffer capacity to UTF8_putc().
For BMP code points above U+07FF, UTF-8 requires three bytes, but the
forwarded capacity can be just two bytes. UTF8_putc() then returns -1,
and this negative value is added to the output length without
validation, causing the length to become negative. The subsequent
trailing NUL byte is then written at a negative offset, causing write
outside of heap allocated buffer.  The vulnerability is reachable via
the public PKCS12_get_friendlyname() API when parsing attacker-
controlled PKCS#12 files. While PKCS12_parse() uses a different code
path that avoids this issue, PKCS12_get_friendlyname() directly
invokes the vulnerable function. Exploitation requires an attacker to
provide a malicious PKCS#12 file to be parsed by the application and
the attacker can just trigger a one zero byte write before the
allocated buffer. For that reason the issue was assessed as Low
severity according to our Security Policy.  The FIPS modules in 3.6,
3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12
implementation is outside the OpenSSL FIPS module boundary.  OpenSSL
3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-69419");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);