Cisco IOS Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

#TRUSTED 43a873f1d9664a8470848d40a4c3d7b7a6d5c4f45618b714bc49caf3114027475403779ed20ad057ee86d5792b9733d07b2b060efc329430fa0de9d4414d4d68ce08d763674171af1eeea90355b262b2604f5cbb8f23c069bc210503f7b88ff65d4c6f0dc259d69ef0a52e74a5ed076d140778825225b34229c8d81f56ff676f4e5e3aa301c3ec9f2cfcdb1b89abc7916075efeffaac1050ce4a63064c1caf075d8aaac3bf0c9585293ddedc0230628ca4e6de7d34beb96ea21656be044872b51db9f5c65ad7a1f377006cab9990c80493538cb77fb3e43d12bc38b45dcd68286a7b44e16f0f6d312c42751155f51a3841f0ff02416198e83931eecddf44c788350e1c8b404fdb2ce13f13cfc1d8b028d8ff14e0fd2c3d857d7053bc72d916d93c8352b0915e91282f1929e729961ba1162a695069abddaf977004e128489bb53cc1bb0327bf782d7c8ee00a7b7a71a8893317038b057ed0d163fb430b06b198ed105d1319937b33fbd9737d8a4a77a38d62a916623beff8542acccef05143211b315e04855d0cc483b53e1aa2fd7872bb849472cf5ae30aaa2629f387f7ec959b7d9d6429ac94b4ca1aa9d4ee82f7ce3c09e70469fda8feb50bd9edd5b95d262409c0821c2e913f3cf79293d7ef727263ecfe16ecfe0ed3f776a033b8e9fcc0539f4569a5459832a5f8c8ccb141edb9c882718b15c9afcf51039d17b3a857c2
#TRUST-RSA-SHA256 45bd2a7bdaea75d9696f25950807e3dba601a864e7cf09bf19576ed6dade7dcb6ba07f425d3c147f43eab38942a2aa47a59e61dd957b16887b13402820b2f736cefb42ab3d451306ddfec8cd9a67ea8c7bff2d0be6cf01bdf65541978ecd8fd4d747fe9f4a3dc0c9de6094dca7b7982c12a947126d19e0cd5072e29eb494ee33a5fea7a9cb1a3b4fb77f98482f9abbe77556dd42b409ee253cc07788368c15583a633792032c221570e6590039edc8fbf5ac80693569d99f55bb3b750310763be6a6176522197f8a03ea8715df785c2bb24878dcfa019a32ce309a62322144bbb9ccb4efbf1ef6d5186e991ee703ae43c73ccf04959d1470b3ee67225facc5217276411563f8d7fbb7eee4d165c87840ebedcbd2c8a36746a694c5b515aefc6fe0d1fc2c3b53277bfab1dfa82a016845725befd607798a7cd1b482c71ace3d5b8c6357a66ac1173d944f61ab6d9c2fce723e2cec3d28ad6754b9206f842d92cf1dd97b0ca2120c1b6f8dc846f21e5aa84e4df5b194a3dc790f3a8cc872df31a6f749835203641b1293360f41191e985222c162ab26213b6587cbd26125a2cd4ebe28c5b0cc002c9d43db1e05687a915ecad1139cd0499749935f5cc8e64fbb5565ef64025d247b5f003b2275cd14891224a74b904c2d274c996f6f3f6b6d82a6340ee10f6ed158c5a2c756a445f6a70ff7a9d1469e15f9bc44df472201e3bc21
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333311);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/10");

  script_cve_id("CVE-2026-20301");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu20827");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ios-xmcp-thbAr34t");
  script_xref(name:"IAVA", value:"2026-A-0807");

  script_name(english:"Cisco IOS Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS is affected by a denial of service vulnerability. A flaw exists in the
Extensible Messaging Client Protocol (XMCP) due to improper handling of malformed XMCP packets. An unauthenticated,
remote attacker can exploit this issue, via a malformed XMCP packet, to cause the system to stop responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75851b9b");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu20827");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu20827");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20301");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(606);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS');

var version_list=make_list(
  '12.2(6)I1',
  '15.2(1)SY5',
  '15.2(1)SY6',
  '15.2(1)SY7',
  '15.2(1)SY8',
  '15.2(2)E8',
  '15.2(2)E9',
  '15.2(2)E9a',
  '15.2(2)E10',
  '15.2(2)E10a',
  '15.2(2)E10b',
  '15.2(2)E10c',
  '15.2(4)E5',
  '15.2(4)E6',
  '15.2(4)E7',
  '15.2(4)E8',
  '15.2(4)E9',
  '15.2(4)E10',
  '15.2(4)E10a',
  '15.2(4)E10b',
  '15.2(4)E10c',
  '15.2(4)E10d',
  '15.2(4)E10e',
  '15.2(4)EA6',
  '15.2(4)EA7',
  '15.2(4)EA8',
  '15.2(4)EA9',
  '15.2(4)EA9a',
  '15.2(4q)E1',
  '15.2(4s)E1',
  '15.2(5)E2c',
  '15.2(6)E',
  '15.2(6)E0a',
  '15.2(6)E0c',
  '15.2(6)E1',
  '15.2(6)E1a',
  '15.2(6)E1s',
  '15.2(6)E2',
  '15.2(6)E2a',
  '15.2(6)E2b',
  '15.2(6)E3',
  '15.2(7)E',
  '15.2(7)E0a',
  '15.2(7)E0b',
  '15.2(7)E0s',
  '15.2(7)E1',
  '15.2(7)E1a',
  '15.2(7)E2',
  '15.2(7)E2a',
  '15.2(7)E2b',
  '15.2(7)E3',
  '15.2(7)E3k',
  '15.2(7)E4',
  '15.2(7)E5',
  '15.2(7)E6',
  '15.2(7)E7',
  '15.2(7)E8',
  '15.2(7)E9',
  '15.2(7)E10',
  '15.2(7)E11',
  '15.2(7)E12',
  '15.2(7)E13',
  '15.2(7)E14',
  '15.2(7a)E0b',
  '15.2(7b)E0b',
  '15.2(8)E',
  '15.2(8)E1',
  '15.2(8)E2',
  '15.2(8)E3',
  '15.2(8)E4',
  '15.2(8)E5',
  '15.2(8)E6',
  '15.2(8)E7',
  '15.2(8)E8',
  '15.2(8)E9',
  '15.3(3)M10',
  '15.3(3)S10',
  '15.4(1)SY3',
  '15.4(1)SY4',
  '15.4(3)M8',
  '15.4(3)M9',
  '15.4(3)M10',
  '15.4(3)S8',
  '15.4(3)S9',
  '15.4(3)S10',
  '15.5(1)SY1',
  '15.5(1)SY2',
  '15.5(1)SY3',
  '15.5(1)SY4',
  '15.5(1)SY5',
  '15.5(1)SY6',
  '15.5(1)SY7',
  '15.5(1)SY8',
  '15.5(1)SY9',
  '15.5(1)SY10',
  '15.5(1)SY11',
  '15.5(1)SY12',
  '15.5(1)SY13',
  '15.5(1)SY14',
  '15.5(1)SY15',
  '15.5(1)SY16',
  '15.5(1)SY17',
  '15.5(3)M6',
  '15.5(3)M6a',
  '15.5(3)M7',
  '15.5(3)M8',
  '15.5(3)M9',
  '15.5(3)M10',
  '15.5(3)M11',
  '15.5(3)M11a',
  '15.5(3)M11b',
  '15.5(3)S6',
  '15.5(3)S6a',
  '15.5(3)S6b',
  '15.5(3)S7',
  '15.5(3)S8',
  '15.5(3)S9',
  '15.5(3)S9a',
  '15.5(3)S10',
  '15.5(3)S10a',
  '15.5(3)S10b',
  '15.6(1)S4',
  '15.6(2)S4',
  '15.6(2)SP3',
  '15.6(2)SP4',
  '15.6(2)SP5',
  '15.6(2)SP6',
  '15.6(2)SP7',
  '15.6(2)SP8',
  '15.6(2)SP8a',
  '15.6(2)SP9',
  '15.6(2)T3',
  '15.6(3)M3',
  '15.6(3)M3a',
  '15.6(3)M4',
  '15.6(3)M5',
  '15.6(3)M6',
  '15.6(3)M6a',
  '15.6(3)M6b',
  '15.6(3)M7',
  '15.6(3)M8',
  '15.6(3)M9',
  '15.6(5)SN',
  '15.6(7)SN',
  '15.6(7)SN1',
  '15.6(7)SN2',
  '15.7(3)M',
  '15.7(3)M0a',
  '15.7(3)M1',
  '15.7(3)M2',
  '15.7(3)M3',
  '15.7(3)M4',
  '15.7(3)M4a',
  '15.7(3)M4b',
  '15.7(3)M5',
  '15.7(3)M6',
  '15.7(3)M7',
  '15.7(3)M8',
  '15.7(3)M9',
  '15.7(3)M10',
  '15.7(3)M10a',
  '15.7(3)M10b',
  '15.8(3)M',
  '15.8(3)M0a',
  '15.8(3)M0b',
  '15.8(3)M1',
  '15.8(3)M1a',
  '15.8(3)M2',
  '15.8(3)M2a',
  '15.8(3)M3',
  '15.8(3)M3a',
  '15.8(3)M3b',
  '15.8(3)M4',
  '15.8(3)M5',
  '15.8(3)M6',
  '15.8(3)M7',
  '15.8(3)M8',
  '15.8(3)M9',
  '15.9(3)M',
  '15.9(3)M0a',
  '15.9(3)M1',
  '15.9(3)M2',
  '15.9(3)M2a',
  '15.9(3)M3',
  '15.9(3)M3a',
  '15.9(3)M3b',
  '15.9(3)M4',
  '15.9(3)M4a',
  '15.9(3)M5',
  '15.9(3)M6',
  '15.9(3)M6a',
  '15.9(3)M6b',
  '15.9(3)M7',
  '15.9(3)M7a',
  '15.9(3)M8',
  '15.9(3)M8a',
  '15.9(3)M8b',
  '15.9(3)M9',
  '15.9(3)M9a',
  '15.9(3)M10',
  '15.9(3)M11',
  '15.9(3)M12',
  '15.9(3)M13',
  '15.9(3)M14'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['xmcp_enabled'];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu20827'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);