Cisco IOS XE Software Wireless Controller for the Catalyst 9000 Family Improper Access Control (cisco-sa-ewlc-icmpv6-qb9eYyCR)

#TRUSTED 3c788950132f9cc70772d3508c45b174d5af934d546159d45bcc60d5033123f26009892e89c78f37022d394d9045b1617e1d8502d29bce10b8e789abc21b0058ab4af782a3f8516f00c65b8260dfdd3095d835605b43019651742a70bd6fd39fa75e2497e6d149d77bac3cf70f3f21bc8045bbfce2952a21732d0d0be45415e5a1ad314381c171e14e3c7ff3841217fa9f474a8a223c0e266ea1192ae5af64f639a801322c9769f27480a482251bcfaf7a9d46fedb67da0c930aa671f8379400851d2f442005e18a7fd84a941f98e95b6a5f3cc020de5ea95ff7e99c86fc7ff984551a8d10414ccb2e2e628412fee56a94fb18c619f4a0837583f0b0addaa4b798e6e55e235a22ecfd1c1eefaffbf4b7f17ebb537d7dc1eea9a9f9e3c3ab2293190a4db0caac64acc80a7b4525613b58f8a0fab37e8e78348b18bf2efad136216ca5b4ec423110b631cbdeaac8e9fe681b3e47ca31c35d39d40fb477124f5a5d5154150647cea08411e95438d408df30b5af9e6461535a071b08b08b515d57955bf5fd2fcf0c94458e02de4a9b6a6437d7be89b3eb7e7987e0a4b8c414a36ff37dda93402ef14442c6abf327902e339170c2c9c9f2dcb19c2523504cd0753a91aa305197a8cb7de244ac57c6f2439bf1e9c659ec9eafa66a1e3fa5c74326d8c5f54530a4233f5666384c6602585c5b28a4366f83b0c830cb4598845d7f48e6b1
#TRUST-RSA-SHA256 73e369bda65ddab23a0b45f0d227e3f6cedabbe9359e1e2409dc7a489873717fe9e1c56f0a9646924eee4ca2290a585909a11a1eb96f9873392aed17e2148fccdb9b3f4347132911e8e7aac69f95796345989c30603b2a2468c3d0a59d3d93c627ea465bb056a8988eca3bc5fcbafb645469920db4d8bc6225fab43185a2e13ac9f145484158b53684c1e47dbfb201f3a5f461eb0aded9c56d50dd8ea50d16db757a5a278d2dffd0c8f5dfd117c6b08eb3c794010dc569e4e4dede692c1a63483d519eee7a957aecc24f6d82e01a6ca10e344e28112ee2b2722fe210eadc90af258978e920d87f24f4c2b4fed5d7879f0f3628ecb7077ec3f8ce763c1edb35d8757031bef16ee583055be2aba8c0d442459dcd49f147eea4766c182a9b0fc91535741f1a8a897ac8551c55ec7f4f0fce1c06b9c49e0c60a96715940ced2bbe7cddbb7e5be89e097608670d6fc14ea5bdea54838c95eef70c28022e4dbe0d39cb27f6ccd45f93212a0b2ef8f6b823a10bd5544c32f64af8308581891c4f3147ec3ae68b5507af0d29514cbc863cfb434cf47a05bcd27200850cec156ea809e0c9098fd54f37d8de55d910cfd6919808a52040aac024e88bceafc738259fa9bd0f5327f3b7a528a17d0ab4608be85733641577afc70283d3852968b3b91ffd5f6337828bce5b901ab5c009af286e6d9f72e62d330ed18c8783b582f5545415ed76
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(144197);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/09/28");

  script_cve_id("CVE-2020-3418");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvr07309");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ewlc-icmpv6-qb9eYyCR");
  script_xref(name:"IAVA", value:"2020-A-0439-S");

  script_name(english:"Cisco IOS XE Software Wireless Controller for the Catalyst 9000 Family Improper Access Control (cisco-sa-ewlc-icmpv6-qb9eYyCR)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Wireless Controller Software for Cisco Catalyst 9000 Family
Routers is affected by an improper access control vulnerability due to an incomplete access control list (ACL) being
applied prior to RUN state. An attacker could exploit this vulnerability by connecting to the associated service set
identifier (SSID) and sending ICMPv6 traffic. A successful exploit could allow the attacker to send ICMPv6 traffic
prior to RUN state. 

Please see the included Cisco BID and Cisco Security Advisory for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-icmpv6-qb9eYyCR
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7a00821e");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr07309");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvr07309");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-3418");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/09/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/12/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version", "Host/Cisco/IOS-XE/Model");

  exit(0);
}

include('ccf.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

model = product_info['model'];
device_model = get_kb_item_or_exit('Host/Cisco/device_model');

# Affects Cisco Catalyst 9100, 9300, 9400, 9500, 9800
if ('cat' >!< tolower(device_model) || (model !~ '9[13458][0-9][0-9]'))
  audit(AUDIT_HOST_NOT, 'affected');

vuln_versions = make_list(
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.12.1',
  '16.12.1s',
  '16.12.1t',
  '16.12.2s',
  '16.12.2t',
  '17.1.1'
);

reporting = make_array(
  'port'     , product_info['port'], 
  'severity' , SECURITY_NOTE,
  'version'  , product_info['version'],
  'bug_id'   , 'CSCvr07309',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:vuln_versions
);