Cisco IOS XE Software Privilege Escalation (cisco-sa-iosxe-privesc-su7scvdp)

#TRUSTED 309af307e8d34e507b1721147f30c8aad7248f00a5a7eb7958305f3a753c2534ec410704668439d839f1e6b27230ab9f3e9c1f0e5d06f2cb359c263547c926a1d2858e35a9a6082deb71a00ac8dbc1ea06e2a64c9ad3acc10d1181b46a7a6ef3190e8ddfae15a51769acd6e21e0194a4cfc0f57ec5de32cbbd7684f5a8b3c33702ea3f60671541fb8f076ee47289817e61d42364cdcad4a4cc58b7edb24e7b7d9654da1e33de0051189cf5794c5d4bbb4600bc0bd985f6549e74170b093ad0de26561198bc45f90ee8ad12b841e742f06fd1bdbb4410d6c59fd220e40979cebc9712ab326ec78b9794ce248f5e08a3805f3a05c60df206462221eb626b2fd4f1015afa5d837c367c319f01b60a04b9d64d1996ecff828f9ba53041da62060f8ad73b58d4f026525d7a45c023637b2a385492010d0c3951be786d8dd2404b636c2d9ccd564f71bf50b2552c846930eb5b5b7cde9afc7bd19507da752da3b62575b54e975ee068e60236933402f5e5019e32372b83db533c32ddd3da1bf1b5cea8575906aa80495a5fd28f77c48a5338e773e84e8ddaedf2a9064bd26836cd5a9f2831549d6e3ab19e6693b8b0a6d194c0bbb02c56c1929425735669ea61a256f33ef1bf64120fa10c243e9eb6bbf69e522d1c1641c6f73a302753cea299fca0b959bca47ee49c3c2e964ba07983476fdf58a6075d750dcffecf2c658113f2e5c2
#TRUST-RSA-SHA256 78141e855da738f064a93aac980e7fb7e81bde14ee13fbea8f4a4e4b097041eef0d9291528008be6feb537b79394728dbc17f6bfe2b1d9868f9dfb894255f17cc2de9e1323b6c1a66ec38bdd53e529145bc6ebfdda8b044ef7a2353baed190ec463bcad19293bf93d14b263b69c408072f7318f95654164e3329aa111560ba53d16621205b44fa874928d1f1105919205619597bad1e0c59e81ba37ecd0004dd8f594f324ab6b37a4fd33e84c397cc6e55f4c1ebfba73a02ecc1c844a811604162360c0cda2aa3e3dbeac8b1ef298bcd9306790d5f63106dfb72187e2602ef1b364d7d681a028b5608c955d3b7e0eccfdd2b00091eadeef49d0652e9977b64f4cd9ece87a40061b4358e05d4808feae79c36ba5ac7b5db8e746e9ce25916804748b825268cea0cb3ec01250a706f67caae8482a5e992acdd215c2d8a9298f7d39bfc37683bb3a0f050dd211f9ec41ae1680864360387acf5da9650c9b0b1885dba50979ca1d7ece651e54164a5b911952870ea947ba5f04ad0547d0cda806603fffe06ad720e9104e8d3ec6d151765321cbaa8e46771232aadf0a92e56b4455917e1aa4c183c877d11853722016a103f39ecbe999db870813155a9f74653bfb56b3cc1b04864ea262f4bfca38ac5dd416542dc0f1b47dc06240e0fa9fbf598f638ddb36a290297072671ded3e828f8330cda6f5f6f632e93662058aa788eb834
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(235482);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/09");

  script_cve_id(
    "CVE-2025-20197",
    "CVE-2025-20198",
    "CVE-2025-20199",
    "CVE-2025-20200",
    "CVE-2025-20201"
  );
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm59330");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm64309");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm66565");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm68661");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwm72787");
  script_xref(name:"CISCO-SA", value:"cisco-sa-iosxe-privesc-su7scvdp");
  script_xref(name:"IAVA", value:"2025-A-0318");

  script_name(english:"Cisco IOS XE Software Privilege Escalation (cisco-sa-iosxe-privesc-su7scvdp)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities.

  - A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with
    privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
    This vulnerability is due to insufficient input validation when processing specific configuration
    commands. An attacker could exploit this vulnerability by including crafted input in specific
    configuration commands. A successful exploit could allow the attacker to elevate privileges to root on the
    underlying operating system of an affected device. The security impact rating (SIR) of this advisory has
    been raised to High because an attacker could gain access to the underlying operating system of the
    affected device and perform potentially undetected actions. Note: The attacker must have privileges to
    enter configuration mode on the affected device. This is usually referred to as privilege level 15.
    (CVE-2025-20197, CVE-2025-20198, CVE-2025-20199, CVE-2025-20200, CVE-2025-20201)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-privesc-su7scvdp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bf7f959f");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75279
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?564dd2a1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm59330");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm64309");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm66565");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm68661");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm72787");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwm59330, CSCwm64309, CSCwm66565, CSCwm68661,
CSCwm72787");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:P/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20197");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 754);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/05/07");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

var version_list=make_list(
  '3.2.0SE',
  '3.2.1SE',
  '3.2.2SE',
  '3.2.3SE',
  '3.3.0SE',
  '3.3.0SG',
  '3.3.1SE',
  '3.3.1SG',
  '3.3.2SE',
  '3.3.2SG',
  '3.3.3SE',
  '3.3.4SE',
  '3.3.5SE',
  '3.4.0SG',
  '3.4.1SG',
  '3.4.2SG',
  '3.4.3SG',
  '3.4.4SG',
  '3.4.5SG',
  '3.4.6SG',
  '3.4.7SG',
  '3.4.8SG',
  '3.5.0E',
  '3.5.1E',
  '3.5.2E',
  '3.5.3E',
  '3.6.0E',
  '3.6.0aE',
  '3.6.0bE',
  '3.6.1E',
  '3.6.2E',
  '3.6.2aE',
  '3.6.3E',
  '3.6.4E',
  '3.6.5E',
  '3.6.5aE',
  '3.6.5bE',
  '3.6.6E',
  '3.6.7E',
  '3.6.7aE',
  '3.6.7bE',
  '3.6.8E',
  '3.6.9E',
  '3.6.9aE',
  '3.6.10E',
  '3.7.0E',
  '3.7.0S',
  '3.7.0bS',
  '3.7.0xaS',
  '3.7.0xbS',
  '3.7.1E',
  '3.7.1S',
  '3.7.1aS',
  '3.7.2E',
  '3.7.2S',
  '3.7.2tS',
  '3.7.3E',
  '3.7.3S',
  '3.7.4E',
  '3.7.4S',
  '3.7.4aS',
  '3.7.5E',
  '3.7.5S',
  '3.7.6S',
  '3.7.7S',
  '3.7.8S',
  '3.8.0E',
  '3.8.0S',
  '3.8.1E',
  '3.8.1S',
  '3.8.2E',
  '3.8.2S',
  '3.8.3E',
  '3.8.4E',
  '3.8.5E',
  '3.8.5aE',
  '3.8.6E',
  '3.8.7E',
  '3.8.8E',
  '3.8.9E',
  '3.8.10E',
  '3.8.10cE',
  '3.8.10dE',
  '3.9.0E',
  '3.9.0S',
  '3.9.0aS',
  '3.9.0xaS',
  '3.9.1E',
  '3.9.1S',
  '3.9.1aS',
  '3.9.2E',
  '3.9.2S',
  '3.9.2bE',
  '3.10.0E',
  '3.10.0S',
  '3.10.0cE',
  '3.10.1E',
  '3.10.1S',
  '3.10.1aE',
  '3.10.1sE',
  '3.10.1xbS',
  '3.10.1xcS',
  '3.10.2E',
  '3.10.2S',
  '3.10.2aS',
  '3.10.2tS',
  '3.10.3E',
  '3.10.3S',
  '3.10.4S',
  '3.10.5S',
  '3.10.6S',
  '3.10.7S',
  '3.10.8S',
  '3.10.8aS',
  '3.10.9S',
  '3.10.10S',
  '3.11.0E',
  '3.11.0S',
  '3.11.1E',
  '3.11.1S',
  '3.11.1aE',
  '3.11.2E',
  '3.11.2S',
  '3.11.2aE',
  '3.11.3E',
  '3.11.3S',
  '3.11.3aE',
  '3.11.4E',
  '3.11.4S',
  '3.11.5E',
  '3.11.6E',
  '3.11.7E',
  '3.11.8E',
  '3.11.9E',
  '3.11.10E',
  '3.11.11E',
  '3.12.0S',
  '3.12.0aS',
  '3.12.1S',
  '3.12.2S',
  '3.12.3S',
  '3.12.4S',
  '3.13.0S',
  '3.13.0aS',
  '3.13.1S',
  '3.13.2S',
  '3.13.2aS',
  '3.13.3S',
  '3.13.4S',
  '3.13.5S',
  '3.13.5aS',
  '3.13.6S',
  '3.13.6aS',
  '3.13.6bS',
  '3.13.7S',
  '3.13.7aS',
  '3.13.8S',
  '3.13.9S',
  '3.13.10S',
  '3.14.0S',
  '3.14.1S',
  '3.14.2S',
  '3.14.3S',
  '3.14.4S',
  '3.15.0S',
  '3.15.1S',
  '3.15.1cS',
  '3.15.2S',
  '3.15.3S',
  '3.15.4S',
  '3.16.0S',
  '3.16.0aS',
  '3.16.0bS',
  '3.16.0cS',
  '3.16.1S',
  '3.16.1aS',
  '3.16.2S',
  '3.16.2aS',
  '3.16.2bS',
  '3.16.3S',
  '3.16.3aS',
  '3.16.4S',
  '3.16.4aS',
  '3.16.4bS',
  '3.16.4cS',
  '3.16.4dS',
  '3.16.4eS',
  '3.16.4gS',
  '3.16.5S',
  '3.16.5aS',
  '3.16.5bS',
  '3.16.6S',
  '3.16.6bS',
  '3.16.7S',
  '3.16.7aS',
  '3.16.7bS',
  '3.16.8S',
  '3.16.9S',
  '3.16.10S',
  '3.16.10aS',
  '3.16.10bS',
  '3.17.0S',
  '3.17.1S',
  '3.17.1aS',
  '3.17.2S',
  '3.17.3S',
  '3.17.4S',
  '3.18.0S',
  '3.18.0SP',
  '3.18.0aS',
  '3.18.1S',
  '3.18.1SP',
  '3.18.1aSP',
  '3.18.1bSP',
  '3.18.1cSP',
  '3.18.1gSP',
  '3.18.1hSP',
  '3.18.1iSP',
  '3.18.2S',
  '3.18.2SP',
  '3.18.2aSP',
  '3.18.3S',
  '3.18.3SP',
  '3.18.3aSP',
  '3.18.3bSP',
  '3.18.4S',
  '3.18.4SP',
  '3.18.5SP',
  '3.18.6SP',
  '3.18.7SP',
  '3.18.8aSP',
  '3.18.9SP',
  '16.1.1',
  '16.1.2',
  '16.1.3',
  '16.2.1',
  '16.2.2',
  '16.3.1',
  '16.3.1a',
  '16.3.2',
  '16.3.3',
  '16.3.4',
  '16.3.5',
  '16.3.5b',
  '16.3.6',
  '16.3.7',
  '16.3.8',
  '16.3.9',
  '16.3.10',
  '16.3.11',
  '16.4.1',
  '16.4.2',
  '16.4.3',
  '16.5.1',
  '16.5.1a',
  '16.5.1b',
  '16.5.2',
  '16.5.3',
  '16.6.1',
  '16.6.2',
  '16.6.3',
  '16.6.4',
  '16.6.4a',
  '16.6.4s',
  '16.6.5',
  '16.6.5a',
  '16.6.5b',
  '16.6.6',
  '16.6.7',
  '16.6.7a',
  '16.6.8',
  '16.6.9',
  '16.6.10',
  '16.7.1',
  '16.7.1a',
  '16.7.1b',
  '16.7.2',
  '16.7.3',
  '16.7.4',
  '16.8.1',
  '16.8.1a',
  '16.8.1b',
  '16.8.1c',
  '16.8.1d',
  '16.8.1e',
  '16.8.1s',
  '16.8.2',
  '16.8.3',
  '16.9.1',
  '16.9.1a',
  '16.9.1b',
  '16.9.1c',
  '16.9.1d',
  '16.9.1s',
  '16.9.2',
  '16.9.2a',
  '16.9.2s',
  '16.9.3',
  '16.9.3a',
  '16.9.3h',
  '16.9.3s',
  '16.9.4',
  '16.9.4c',
  '16.9.5',
  '16.9.5f',
  '16.9.6',
  '16.9.7',
  '16.9.8',
  '16.9.8a',
  '16.9.8b',
  '16.10.1',
  '16.10.1a',
  '16.10.1b',
  '16.10.1c',
  '16.10.1d',
  '16.10.1e',
  '16.10.1f',
  '16.10.1g',
  '16.10.1s',
  '16.10.2',
  '16.10.3',
  '16.11.1',
  '16.11.1a',
  '16.11.1b',
  '16.11.1c',
  '16.11.1s',
  '16.11.2',
  '16.12.1',
  '16.12.1a',
  '16.12.1c',
  '16.12.1s',
  '16.12.1t',
  '16.12.1w',
  '16.12.1x',
  '16.12.1y',
  '16.12.1z',
  '16.12.1z1',
  '16.12.1z2',
  '16.12.2',
  '16.12.2a',
  '16.12.2s',
  '16.12.2t',
  '16.12.3',
  '16.12.3a',
  '16.12.3s',
  '16.12.4',
  '16.12.4a',
  '16.12.5',
  '16.12.5a',
  '16.12.5b',
  '16.12.6',
  '16.12.6a',
  '16.12.7',
  '16.12.8',
  '16.12.9',
  '16.12.10',
  '16.12.10a',
  '16.12.11',
  '16.12.12',
  '17.1.1',
  '17.1.1a',
  '17.1.1s',
  '17.1.1t',
  '17.1.2',
  '17.1.3',
  '17.2.1',
  '17.2.1a',
  '17.2.1r',
  '17.2.1v',
  '17.2.2',
  '17.2.3',
  '17.3.1',
  '17.3.1a',
  '17.3.1w',
  '17.3.1x',
  '17.3.1z',
  '17.3.2',
  '17.3.2a',
  '17.3.3',
  '17.3.3a',
  '17.3.4',
  '17.3.4a',
  '17.3.4b',
  '17.3.4c',
  '17.3.5',
  '17.3.5a',
  '17.3.5b',
  '17.3.6',
  '17.3.7',
  '17.3.8',
  '17.3.8a',
  '17.4.1',
  '17.4.1a',
  '17.4.1b',
  '17.4.1c',
  '17.4.2',
  '17.4.2a',
  '17.5.1',
  '17.5.1a',
  '17.5.1b',
  '17.5.1c',
  '17.6.1',
  '17.6.1a',
  '17.6.1w',
  '17.6.1x',
  '17.6.1y',
  '17.6.1z',
  '17.6.1z1',
  '17.6.2',
  '17.6.3',
  '17.6.3a',
  '17.6.4',
  '17.6.5',
  '17.6.5a',
  '17.6.6',
  '17.6.6a',
  '17.6.7',
  '17.6.8',
  '17.6.8a',
  '17.7.1',
  '17.7.1a',
  '17.7.1b',
  '17.7.2',
  '17.8.1',
  '17.8.1a',
  '17.9.1',
  '17.9.1a',
  '17.9.1w',
  '17.9.1x',
  '17.9.1x1',
  '17.9.1y',
  '17.9.1y1',
  '17.9.2',
  '17.9.2a',
  '17.9.3',
  '17.9.3a',
  '17.9.4',
  '17.9.4a',
  '17.9.5',
  '17.9.5a',
  '17.9.5b',
  '17.9.5c',
  '17.9.5d',
  '17.9.5e',
  '17.9.5f',
  '17.9.6',
  '17.9.6a',
  '17.9.6b',
  '17.10.1',
  '17.10.1a',
  '17.10.1b',
  '17.11.1',
  '17.11.1a',
  '17.11.99SW',
  '17.12.1',
  '17.12.1a',
  '17.12.1w',
  '17.12.1x',
  '17.12.1y',
  '17.12.1z',
  '17.12.1z1',
  '17.12.2',
  '17.12.2a',
  '17.12.3',
  '17.12.3a',
  '17.12.4',
  '17.12.4a',
  '17.12.4b',
  '17.13.1',
  '17.13.1a',
  '17.14.1',
  '17.14.1a',
  '17.15.1',
  '17.15.1a',
  '17.15.1b',
  '17.15.1w'
);

var reporting = make_array(
  'port'          , product_info['port'],
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwm59330, CSCwm64309, CSCwm66565, CSCwm68661, CSCwm72787',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);