Veeder-Root TLS4B Command Injection (CVE-2025-58428)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505883);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/31");

  script_cve_id("CVE-2025-58428");
  script_xref(name:"ICSA", value:"26-174-06");
  script_xref(name:"ICSA", value:"25-296-03");

  script_name(english:"Veeder-Root TLS4B Command Injection (CVE-2025-58428)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The TLS4B ATG system's SOAP-based interface is vulnerable due to
its accessibility through the web services handler. This
vulnerability enables remote attackers with valid credentials to
execute system-level commands on the underlying Linux system. This
could allow the attacker to achieve remote command execution, full
shell access, and potential lateral movement within the network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-296-03");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/ICSA-26-174-06");
  script_set_attribute(attribute:"solution", value:
"Veeder-Root recommends users upgrade the TLS4B to Version 11.A.

Contact Veeder-Root Technical Support at +1.800.323.1799 for
additional help or questions.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-58428");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:veeder-root:tls4b_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/VeederRoot");

  exit(0);
}

include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/VeederRoot');

var asset = tenable_ot::assets::get(vendor:'VeederRoot');

var vuln_cpes = {
    "cpe:/o:veeder-root:tls4b_firmware" :
        {"versionEndExcluding" : "11.A", "family" : "VeederRootATG"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);