Veeder-Root TLS4B Integer Overflow or Wraparound (CVE-2025-55067)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505882);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2025-55067");
  script_xref(name:"ICSA", value:"25-296-03");

  script_name(english:"Veeder-Root TLS4B Integer Overflow or Wraparound (CVE-2025-55067)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The TLS4B ATG system is vulnerable to improper handling of Unix
time values that exceed the 2038 epoch rollover. When the system
clock reaches January 19, 2038, it resets to December 13, 1901,
causing authentication failures and disrupting core system
functionalities such as login access, history visibility, and leak
detection termination. This vulnerability could allow an attacker
to manipulate the system time to trigger a denial of service (DoS)
condition, leading to administrative lockout, operational timer
failures, and corrupted log entries.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03");
  script_set_attribute(attribute:"solution", value:
"Veeder-Root is aware of the vulnerability and will provide a fix
for it. Until a fix is available, users should adhere to the
network security best practices provided by Veeder-Root.
Additionally, users should make all efforts to protect the borders
of their environment to prevent bad actors from infiltrating and
causing this issue.

Contact Veeder-Root Technical Support at +1.800.323.1799 for
additional help or questions.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55067");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(190);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:veeder-root:tls4b_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/VeederRoot");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/VeederRoot');

var asset = tenable_ot::assets::get(vendor:'VeederRoot');

var vuln_cpes = {
    "cpe:/o:veeder-root:tls4b_firmware" :
        {"versionEndExcluding" : "11.A", "family" : "VeederRootATG"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);