Cisco Access Point Software Secure Boot Bypass (cisco-sa-ap-secureboot-bypass-zT5vJkSD)

#TRUSTED 02439a2cbbd81e0efa865a9a2feee73fe4c5b8e4d89ffaf2246377ae733407dbdad0d0202cb2e33364f3a6d0203613c27b1af7384749e8ee2921913153894721c196c42bde41107e726d4a349fcd0ed33f110fafc9b0dbd7b5fed7a7dd84080723041e407f00d55d982b48a064810303f845e70416b841975678afed4fb509d23ce85f811fdeb60a104298103a6dc547fde59c843fe531a8a2845700633e7dee33924bc16e0789ba28b3134acb8edae69fae3edc92de19a6431f4bf3e7c9839664913d83fb7b85706373be6b62947563e8ad3cf14060dfcb2c3c185d75eee72280dba5570a7a62172005685a3488214e8c8a88b04867a51391cb09b1a7ddb89620e46abdb4b81325b36c058814460d042b74a95f21424c1136e3c1c050de5a018cd8d5636c7eae68d38a746bf3f18b904770509a7ccfd8b29befd70a63969cd5af20ba5e353938de74bd2727a68081b32d34f29e97ab3594b34090393fcf8282bcd91b68897c6dcf794ef2cda0f1c5e8188fbc1fc025eeb3fc46b98c0e5cfe7cb04cc80ff282ec50e93e9e5a648b351e8b05794e9dafa106043349453963b473e98902507e007bffb3ffa29349e16d97dafac7b53ac78579ea1fc4981a43f48b7580b5d40e0cdd8f675cebd52c89791f892950e2eb45c050bc316eaa500ca19b6f73070ff8ff30929bd707e5e05529ddd87daf023cdfd456553aaf7dda45b088
#TRUST-RSA-SHA256 221fc723c6ec7774ebefb2dd327b75cce2132e40fa711cd2bccb5a2c14f13dec0eeaa83722ddd3c5079d9d171747c259263f0567c9bfef519a801b61e520eeb8322c2b97ddc1703c4bd370cf505144991452aa9fd4a45ffaa45afbbe385f8e400b8929f2967b09b032a083bac3df324cee2028ae2d462a8536221a325b7ea548595d0a8005e44f6d004b6f24a79afc539c17637ea6580f13728e796dc844077483c74f0c73fe31252ede9a67904fec12cf5d92e8f9410f0b73a81f22c7538c55cf185a39c84115806c877d83a3dd9a687e186d4f4ef18ffb7fb5960445e5a288d5072ea925ce25763132e154295af6246241b69b345ec0435f300758d1ddbc560e647ca2d2e026f282bff1814f46790861ef9c72475d4b1711718032b24160c35fcf1283fb73b0d1d12874abb330d7de42258ef1d4b274ac17d3408d0f6ba91a91a1ef056946ca34647274e9cbdca4ce2015e145c29f30abb0e1b1174f66d7a761bd0bf1fdc6297861bb6d7dec46f484264597abb8b4a9dbbe2ce8270049726156c28a0866c5304961c19ea392b8459d917fe71cd94e9949be38c6f3c2660416be9299dfcf3b2d9c016a59cc39a19ddd13bf649b911f4481f5f297de1497a73a58fed088571bb8d6e7603545ff1bfd22654fc7a4fe6d176d1df5b0ba2a8bc808972486bbc5b4c9869e37ee38f3b82e2a64afff6f6d381b95c06cf1ada37ef5c9
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(193334);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/15");

  script_cve_id("CVE-2024-20265");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwf62026");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ap-secureboot-bypass-zT5vJkSD");

  script_name(english:"Cisco Access Point Software Secure Boot Bypass (cisco-sa-ap-secureboot-bypass-zT5vJkSD)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Access Point Software Secure Boot Bypass is affected by a vulnerability.

  - A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated,
    physical attacker to bypass the Cisco Secure Boot functionality and load a software image that has been
    tampered with on an affected device. This vulnerability exists because unnecessary commands are available
    during boot time at the physical console. An attacker could exploit this vulnerability by interrupting the
    boot process and executing specific commands to bypass the Cisco Secure Boot validation checks and load an
    image that has been tampered with. This image would have been previously downloaded onto the targeted
    device. A successful exploit could allow the attacker to load the image once. The Cisco Secure Boot
    functionality is not permanently compromised. (CVE-2024-20265)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-secureboot-bypass-zT5vJkSD
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8f22cdd0");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf62026");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwf62026");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20265");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(501);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/03/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/04/15");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");


  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var model = toupper(product_info.model);

# Vulnerable model list
if ('CATALYST' >!< model || model !~ "9105AX|9115|9120AX|9124AX|9130AX|9136")
    audit(AUDIT_HOST_NOT, 'affected');

var vuln_ranges = [
  {'min_ver': '0.0','fix_ver': '17.3.8'},
  {'min_ver': '17.4','fix_ver': '17.6.6'},
  {'min_ver': '17.7', 'fix_ver': '17.9.4'},
  {'min_ver': '17.10', 'fix_ver': '17.12'}
];    

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwf62026',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges
);