Cisco Unified Intelligence Center Arbitrary File Upload (cisco-sa-cuis-file-upload-UhNEtStm)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242838);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-20274");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn18794");
  script_xref(name:"CISCO-SA", value:"cisco-sa-cuis-file-upload-UhNEtStm");
  script_xref(name:"IAVA", value:"2025-A-0536-S");

  script_name(english:"Cisco Unified Intelligence Center Arbitrary File Upload (cisco-sa-cuis-file-upload-UhNEtStm)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Cisco Unified Intelligence Center installed on the remote host is prior to tested version. It is,
therefore, affected by an arbitrary file upload vulnerability as referenced in the cisco-sa-cuis-file-upload-UhNEtStm 
advisory:

  - A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an 
    authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due 
    to improper validation of files that are uploaded to the web-based management interface. An attacker 
    could exploit this vulnerability by uploading arbitrary files to an affected device. A successful exploit 
    could allow the attacker to store malicious files on the system and execute arbitrary commands on the 
    operating system. The Security Impact Rating (SIR) of this advisory has been raised to High because an 
    attacker could elevate privileges to root. To exploit this vulnerability, the attacker must have valid 
    credentials for a user account with at least the role of Report Designer. (CVE-2025-20274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuis-file-upload-UhNEtStm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56a3587c");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn18794");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwn18794");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20274");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/25");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:unified_intelligence_center");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_voss_cuic_installed.nbin");
  script_require_keys("installed_sw/Cisco Unified Intelligence Center (CUIC)", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::get_app_info(app:'Cisco Unified Intelligence Center (CUIC)', win_local:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:3);
var constraints = [
  { 'min_version' : '12.5.0', 'fixed_version':'12.5.1', 'fixed_display':'12.5(1) (Jul 2025) / Bug IDs: CSCwn18794' },
  { 'min_version' : '12.6.0', 'fixed_version':'12.6.2', 'fixed_display':'12.6(2) (Jul 2025) / Bug IDs: CSCwn18794' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);