Cisco IOS XR Software Dedicated XML Agent TCP DoS (cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S)

#TRUSTED 7067b98e4e36b3d8ec31fb02ebf9b1b1618730f68153a67482148559fc0f0c7439e9e380c8718d807b1b43e7bf34b186195f8e3737d5c47bd8dedb5ac9d5cd02a0e8779c3e6bcda4cf43e0bed8d505c4997ecec09e5949be062d77d3dda95e4e62f63fdece45725040cde2ebb7d28d0394137f0a3c59c18786c89a03ebf7dc766cb733ffce36f10233cb448498f71cebea31e1b2596119c274b3705e2b4aa0b5da514e7ccfe8264078b5d0d39f55f624190c69cb5adb9e2a77a05b78ffdfceb8af5543cf8c7938a7fcd06239d402a384f96a50e270d1b3f0a93e64cb5e056bfd1bc236cde47d3de26aa002e677808af922e18ac24089a537b4bc2b5854ba1f624e6f7805613c597bd8511ba50950cc0e673e0b458b2d0b8fd6f57627346f1d07ca5160227eee2b9f6d4af3df40651c3cc0ca48a1a77c8e8cd3e0d821d1b3d2d08738d998931f0dcf4e2341a3782394f365e5977683453cf9b018d6b4e6f6007f1884fc1baeeb78eac3b2bb19ae77955a674d3c1ff1c498c4e9f1b45f66100d470c546c210278ebbd4f67d58c742dc5280855e9c8b7702d10a14389a60becb5cbe3386d19df78c03fde65c83db09e435f7a32bff5ca732987db80d5ead97bf83ddd8ac3e63d7482bc149b1c63c77d57d46406073cc5213400361d91953a1f14fb37faa87af7a4cf0830ce28b75dde2b18eccbacf42a285893cc5cb7ecd8d28072
#TRUST-RSA-SHA256 4d51535fa7d6baaa1d98883baa6e7af5c3114635f25e917ec29ae3554137f2a22df5b3a28e59a17adeb5ece23ef13a7f58f11ff99ca7d723a175d31620c7fb4ba0d2f22ab68f762e493b484b7046ed9d64c80ddbdf32d0cd320c575c68ea118f19fc0ce7eb45cf2898ba3c2f2126a53b76670347c0c9b1e5993c9d4ce7aff00404ab99955d8c941e43133c6f74c7d7cd3817444adf01d2931ed66066737124773604f810dac05b578f561a41495552676c5b9375ef32bd606c8b49aead6c767021b23e1326878e9d98d30a9a90eb04e1ebaeaaeb93efc3f96cfb60b166afef7f857b92d5a0865f91e4664fb479ee498b2b0cf4efa500fc883224d8b92284020333c808f1657064c42f4427288c8ebe55858b3187fdb735373e8f445b41c913d24588cd8b2ad4225f464f040630385b93a9259814b1d4665c07298aa93c8a7ce31a8b892e2309e3e539d1cae30b9c83881fb079aa04e0a605801b12b339d452c779a4afd0b83ceb172d2cbaa1c0bc5f0cb683e83967760313ea16d2b675bb8391f2801e653c2a9b37736e5d34769aa5901e03e676a06c524e3f5b3193fa59ef6e30ff4bef22132cafa9f9efea44e1c4c09e33a8ff3b1647f829c703d1abac7bc0575555e2b59ea5279a3a0aa1f59d7e52856495819beece7871e9ef309ede03f23d02b498db764a436c2059c69bc69a8b9d6507f10b97822d01eb54a76bb288f2
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(214884);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/31");

  script_cve_id("CVE-2024-20390");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwj39201");
  script_xref(name:"CISCO-SA", value:"cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S");
  script_xref(name:"IAVA", value:"2024-A-0573-S");

  script_name(english:"Cisco IOS XR Software Dedicated XML Agent TCP DoS (cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

  - A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an
    unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751. This
    vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could
    exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A
    successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the
    attack traffic persists. (CVE-2024-20390)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5531c048");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75416
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a636b5a5");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj39201");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwj39201");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20390");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(940);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl", "cisco_enum_smu.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var model = toupper(product_info.model);
var smus;

var pattern = "IOSXRWBD|NCS-?5500";
if (preg(string:model, pattern:pattern))
{
  smus['7.11.2'] = 'CSCwj39201';
}

var vuln_ranges = [
  {'min_ver': '0', 'fix_ver': '7.12'},
  {'min_ver': '24.1', 'fix_ver': '24.1.2'}
];

var workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
var workaround_params = WORKAROUND_CONFIG['xml_agent_no_tty'];

var reporting = make_array(
  'port'    , product_info['port'],
  'severity', SECURITY_WARNING,
  'version' , product_info['version'],
  'fix'     , '24.1.2',
  'bug_id'  , 'CSCwj39201'
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  smus:smus
);