Cisco IOS XE Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)

#TRUSTED 404c3630586ee18cfc9091a011cf2d20206ef7ff3faf5a3d45d609ffa25ccdce4139e5cd2d0e7d9c71fa2d4dc55be7e2ac5231ae8233d9141af4506905afd20fc0644ff0f5f17ae4c4c30aceca8ac56ae394c12b4ec59a2ea60aaddc79f3ceb76c63b3da6a68e61405b22332eb00f8565e80e4c8bfb09d20a96631da0571b8d47234fd8cd3032c4ba59b0363e94294c8ed1e925f59d400f5e4f0a2732c3aeb11d2d9683fac095d02d9593c713c39c45a610c2d127854a8af24eaa81a93c54a274a49202df6e1e9b51fb1c1458dcdf09bc3713bb542b068a33934115557ad16baa80b576b4f242ee3b15550baf8774c5f89282e4f5eb8a8b1ad9ec9b8e87621fa8561326cce97340a30e1b2737cb1408423d253ba0c358fad8deeeda92a60442d1bb17af87491450376b37ab0fed9ffc53c14a082dbc23ff5ccb1e5ab38f2667bc7a8086fbeea6be81fef98fbd428e72793cee34c8b6ac186d520b1319ccb4fd55d1ac6bcac0493e5d420dfdf7e1476e5bb6693ea32bce139f984c16a4af6da68ea1e618270823debad991c0b3916f340c20ae8cbfb98310dacc910432e445ec19b00bd8c4ab5f2fd7b0916a5bc7fe41c045f89a5d659a789d720160585ec1c71424c9f580b9fbbb22945c3c668c59741b611b72e40312e9eb6ac7bcab8fb627ffce6f9b964d3d71c3b545c5b0a2cd199aa9efbd9a84da729007560d665d6aa49
#TRUST-RSA-SHA256 a56bb7f2c7ff6acef8406b4206e4206011d850a204e009e4dc19972cfed564f22c687e35297e1321abce0912ffcf7a9568e3cd9e942465f00e54eb3b6e98f6ed68a75b3a941d0516248d855b06772a1f7a487196189cf37867c8567072b9a254fc29385021b124b443fadadcbbcf48ce2fc22d720928ddcdd7148ce227a6cdcc1369e65d48311cecf7f48aa263236d886a5f66493d97d191ecfe61cac4bb33300147c5f807306dc999a0310739949f321e509dfc130d5ebb0cdaca50fe551542a9fba29f4d522f53deefe077955ea7cb5fd26331bbfbf0b56e7e7ce9bc58f114e2bdbc514039e98503bbc864b863c914c3d838de40482ef6a32d8517f3efb0b2bbfd6d6ed96248eefab6d1a4abd473656035eb0eec2a3aa91ec9fd11fc994c49ba63880b0c029bc60f4d6ebf6fd6353fc7fc731ceb3c4b4c0e5274facb1d28f0ebf0f01d3de17920cd2e9ec0d586cdb977d59fd9eb7e269e2b67022abcf89f2ff3a9c8bec0ab36a40a82ad1bc702bfff8475892d20cbb3fdc3ebab1f0aaf627241d752b65d8072e6ec4844126a2ff1e263aa7e390691370ebf4b2a346d379e0043b5e6f77962b95026dc353f4d96d462ae93267b50a1037d17a436764cc040d66be3d0b1a906987b7de0dc244f9c9a46116dbb7b7ef61401994f4c266c1751b7f1373a0fab7cc5d4152c8135104fd57ec887f0a6ed7d80be60f26068fca5955d
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333312);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/10");

  script_cve_id("CVE-2026-20301");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwu20827");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ios-xmcp-thbAr34t");
  script_xref(name:"IAVA", value:"2026-A-0807");

  script_name(english:"Cisco IOS XE Software Extensible Messaging Client Protocol DoS (cisco-sa-ios-xmcp-thbAr34t)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by a denial of service vulnerability. A flaw
exists in the Extensible Messaging Client Protocol (XMCP) due to improper handling of malformed XMCP packets. An
unauthenticated, remote attacker can exploit this issue, via a malformed XMCP packet, to cause the system to stop
responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xmcp-thbAr34t
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?75851b9b");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwu20827");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwu20827");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20301");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(606);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list=make_list(
  '3.6.7aE',
  '3.6.7bE',
  '3.6.8E',
  '3.6.9E',
  '3.6.9aE',
  '3.6.10E',
  '3.8.5E',
  '3.8.5aE',
  '3.8.6E',
  '3.8.7E',
  '3.8.8E',
  '3.8.9E',
  '3.8.10E',
  '3.8.10cE',
  '3.8.10dE',
  '3.10.0E',
  '3.10.0cE',
  '3.10.1E',
  '3.10.1aE',
  '3.10.1sE',
  '3.10.2E',
  '3.10.3E',
  '3.10.10S',
  '3.11.0E',
  '3.11.1E',
  '3.11.1aE',
  '3.11.2E',
  '3.11.2aE',
  '3.11.3E',
  '3.11.3aE',
  '3.11.4E',
  '3.11.5E',
  '3.11.6E',
  '3.11.7E',
  '3.11.8E',
  '3.11.9E',
  '3.11.10E',
  '3.11.11E',
  '3.11.12E',
  '3.11.13E',
  '3.11.14E',
  '3.13.8S',
  '3.13.9S',
  '3.13.10S',
  '3.16.6S',
  '3.16.6bS',
  '3.16.7S',
  '3.16.7aS',
  '3.16.7bS',
  '3.16.8S',
  '3.16.9S',
  '3.16.10S',
  '3.16.10aS',
  '3.16.10bS',
  '3.17.4S',
  '3.18.3SP',
  '3.18.3aSP',
  '3.18.3bSP',
  '3.18.4S',
  '3.18.4SP',
  '3.18.5SP',
  '3.18.6SP',
  '3.18.7SP',
  '3.18.8aSP',
  '3.18.9SP',
  '16.6.1',
  '16.6.2',
  '16.6.3',
  '16.6.4',
  '16.6.4a',
  '16.6.4s',
  '16.6.5',
  '16.6.5a',
  '16.6.5b',
  '16.6.6',
  '16.6.7',
  '16.6.7a',
  '16.6.8',
  '16.6.9',
  '16.6.10',
  '16.7.1',
  '16.7.1a',
  '16.7.1b',
  '16.7.2',
  '16.7.3',
  '16.7.4',
  '16.8.1',
  '16.8.1a',
  '16.8.1b',
  '16.8.1c',
  '16.8.1d',
  '16.8.1e',
  '16.8.1s',
  '16.8.2',
  '16.8.3',
  '16.9.1',
  '16.9.1a',
  '16.9.1b',
  '16.9.1c',
  '16.9.1d',
  '16.9.1s',
  '16.9.2',
  '16.9.2a',
  '16.9.2s',
  '16.9.3',
  '16.9.3a',
  '16.9.3h',
  '16.9.3s',
  '16.9.4',
  '16.9.4c',
  '16.9.5',
  '16.9.5f',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.9.8b',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '16.12.13',
  '16.12.14',
  '16.12.15',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.9.6',
  '17.9.6a',
  '17.9.6b',
  '17.9.7',
  '17.9.7a',
  '17.9.7b',
  '17.9.8',
  '17.9.9',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.1z2',
  '17.12.1z3',
  '17.12.1z4',
  '17.12.1z5',
  '17.12.1z6',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.12.5',
  '17.12.5a',
  '17.12.5b',
  '17.12.5c',
  '17.12.5d',
  '17.12.6',
  '17.12.6a',
  '17.12.6b',
  '17.12.7',
  '17.12.7a',
  '17.12.7b',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w',
  '17.15.1x',
  '17.15.1y',
  '17.15.1z',
  '17.15.2',
  '17.15.2a',
  '17.15.2b',
  '17.15.2c',
  '17.15.3',
  '17.15.3a',
  '17.15.3b',
  '17.15.4',
  '17.15.4a',
  '17.15.4b',
  '17.15.4c',
  '17.15.4d',
  '17.15.4s1',
  '17.15.5',
  '17.15.5a',
  '17.16.1',
  '17.16.1a',
  '17.17.1',
  '17.18.1',
  '17.18.1a',
  '17.18.1w',
  '17.18.1x',
  '17.18.1y',
  '17.18.1z',
  '17.18.2',
  '17.18.3',
  '17.18.3a',
  '26.1.1',
  '26.1.1a',
  '26.2.1ea'
);

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['xmcp_enabled'];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_HOLE,
  'version' , product_info['version'],
  'bug_id'  , 'CSCwu20827'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);