Siemens SIMATIC HMI Device Detection (SNMP)

# SPDX-FileCopyrightText: 2018 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.141682");
  script_version("2026-06-10T06:59:19+0000");
  script_tag(name:"last_modification", value:"2026-06-10 06:59:19 +0000 (Wed, 10 Jun 2026)");
  script_tag(name:"creation_date", value:"2018-11-14 13:52:50 +0700 (Wed, 14 Nov 2018)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:N");

  script_tag(name:"qod_type", value:"remote_banner");

  script_name("Siemens SIMATIC HMI Device Detection (SNMP)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2018 Greenbone AG");
  script_family("Product detection");
  script_dependencies("gb_snmp_info_collect.nasl");
  script_require_udp_ports("Services/udp/snmp", 161);
  script_mandatory_keys("SNMP/sysdescr/available");

  script_tag(name:"summary", value:"SNMP based detection of Siemens SIMATIC HMI devices.");

  exit(0);
}

include("snmp_func.inc");

port = snmp_get_port(default: 161);

if (!sysdesc = snmp_get_sysdescr(port: port))
  exit(0);

# Siemens, SIMATIC HMI, TP900 Comfort, 6AV2 124-0JC01-0AX0, HW: 0, SW: V 13 0 1
# Siemens, SIMATIC HMI, KTP600 Basic Mono PN, 6AV6647-0AB11-3AX0, HW:1, FW:V01.06.00
# Siemens, SIMATIC HMI, MP377, 6AV6 644-0AA01-2AX0, HW: 0, SW: V 1 0 4
# Siemens AG, SIMATIC-HMI, MTP1500 Unified Comfort, 6AV2128-3QB06-0AX0, HW: Version 0, FW: Version V20.0.0, LBP1425373
#
# nb: Keep the pattern "in sync" with the exclusion in gb_snmp_os_detection.nasl
if (sysdesc =~ "Siemens( AG)?, SIMATIC( |-)HMI") {
  set_kb_item(name: "siemens/simatic/hmi/detected", value: TRUE);
  set_kb_item(name: "siemens/simatic/hmi/snmp/detected", value: TRUE);
  set_kb_item(name: "siemens/simatic/hmi/snmp/port", value: port);
  set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/concluded", value: sysdesc);

  sp = split(sysdesc, sep: ",", keep: FALSE);

  if (!isnull(sp[2])) {
    model = eregmatch(pattern: "^ ([^ ]+ ?(Basic|Comfort)?)", string: sp[2]);
    if (!isnull(model[1]))
      set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/model", value: model[1]);
  }

  if (!isnull(sp[5])) {
    vers = eregmatch(pattern: "SW: V ([0-9 ]+)", string: sp[5]);
    if (!isnull(vers[1])) {
      version = str_replace(string: vers[1], find: " ", replace: ".");
      set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/fw_version", value: version);
    }
    else {
      version = eregmatch(pattern: "FW:V([0-9.]+)", string: sp[5]);
      if (!isnull(version[1])) {
        set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/fw_version", value: version[1]);
      } else {
        version = eregmatch(pattern: "FW:\s*Version\s+V([0-9.]+)", string: sp[5]);
        if (!isnull(version[1])) {
          set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/fw_version", value: version[1]);
        }
      }
    }
  }

  if (!isnull(sp[4])) {
    hw = eregmatch(pattern: "HW:\s*(Version\s*)?([0-9]+)", string: sp[4]);
    if (!isnull(hw[2]))
      set_kb_item(name: "siemens/simatic/hmi/snmp/" + port + "/hw_version", value: hw[2]);
  }
}

exit(0);