Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338752);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/24");

  script_cve_id("CVE-2026-20327");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwt51262");
  script_xref(name:"CISCO-SA", value:"cisco-sa-cuic-sql-inject-2qbfWSm5");
  script_xref(name:"IAVA", value:"2026-A-0863");

  script_name(english:"Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an
authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is
due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted
request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the
internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on
the affected device.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e173d1a0");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt51262");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwt51262.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20327");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(89);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_intelligence_center");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_voss_cuic_installed.nbin");
  script_require_keys("installed_sw/Cisco Unified Intelligence Center (CUIC)");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Cisco Unified Intelligence Center (CUIC)');

# Fixed Releases per the advisory:
#   Earlier than 12.6 -> Migrate to a fixed release
#   12.6              -> 12.6(2) ES08
#   15.0              -> 15.0(1) SU2
# The ES / SU patch level is not reflected in the detected base version, so the two
# patched branches are only reported when paranoid scanning is enabled.
var constraints = [
  { 'fixed_version':'12.6', 'fixed_display':'Migrate to 12.6(2) ES08 or 15.0(1) SU2' },
  { 'min_version':'12.6', 'max_version':'12.6.99999', 'fixed_display':'12.6(2) ES08', 'require_paranoia':TRUE },
  { 'min_version':'15.0', 'max_version':'15.0.99999', 'fixed_display':'15.0(1) SU2', 'require_paranoia':TRUE }
];

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING,
  flags:{sqli:TRUE}
);