Veeder-Root TLS4B Command Injection (CVE-2025-58428)

critical Tenable OT Security Plugin ID 505883

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote command execution, full shell access, and potential lateral movement within the network.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

Veeder-Root recommends users upgrade the TLS4B to Version 11.A.

Contact Veeder-Root Technical Support at +1.800.323.1799 for additional help or questions.

Plugin Details

Severity: Critical

ID: 505883

File Name: tenable_ot_veederroot_CVE-2025-58428.nasl

Version: 1.1

Type: Remote

Family: Tenable.ot

Published: 7/28/2026

Updated: 7/28/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.48

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

CPE: cpe:/o:veeder-root:tls4b_firmware

Required KB Items: Tenable.ot/VeederRoot

Patch Publication Date: 10/23/2025

Vulnerability Publication Date: 10/23/2025

Reference Information

CVE: CVE-2025-58428

CWE: 77

ICSA: 25-296-03

Detections

Analytics