Siemens SIMATIC S7-1500 Improper Check for Unusual or Exceptional Conditions (CVE-2025-69420)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505142);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/16");

  script_cve_id("CVE-2025-69420");

  script_name(english:"Siemens SIMATIC S7-1500 Improper Check for Unusual or Exceptional Conditions (CVE-2025-69420)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Issue summary: A type confusion vulnerability exists in the TimeStamp
Response verification code where an ASN1_TYPE union member is accessed
without first validating the type, causing an invalid or NULL pointer
dereference when processing a malformed TimeStamp Response file.
Impact summary: An application calling TS_RESP_verify_response() with
a malformed TimeStamp Response can be caused to dereference an invalid
or NULL pointer when reading, resulting in a Denial of Service.  The
functions ossl_ess_get_signing_cert() and
ossl_ess_get_signing_cert_v2() access the signing cert attribute value
without validating its type. When the type is not V_ASN1_SEQUENCE,
this results in accessing invalid memory through the ASN1_TYPE union,
causing a crash.  Exploiting this vulnerability requires an attacker
to provide a malformed TimeStamp Response to an application that
verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not
widely used and the impact of the exploit is just a Denial of Service.
For these reasons the issue was assessed as Low severity.  The FIPS
modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as
the TimeStamp Response implementation is outside the OpenSSL FIPS
module boundary.  OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are
vulnerable to this issue.  OpenSSL 1.0.2 is not affected by this
issue.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/html/ssa-265688.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-69420");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(754);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/04/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/13");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp" :
        {"versionEndIncluding" : "1.1", "versionStartIncluding" : "1.1", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);