Cisco NX-OS Software Sensitive Log Information Disclosure (cisco-sa-nxos-infodis-TEcTYSFG)

#TRUSTED 0e801f4381b82756715d4b57a1a826d0ed8d183b870341f8e5ca50c18fb26f99695a36b2f996994e35d6f831565514e9fedb1e85373139e39b82cf3ed5eb918486b8315c79f926e0f068bea402a0dd324880a869e66aa4d53b45fd62bbb14473bb4e15917e5e7f369ae6f50f015d695b9770fe2719368385d2e940bc206e72fc4634395c6c738c15c157e8320fb87159e4f48b706f2a81d5a115a9c199a1cb55ab066a376ab82696cb56a708ab0af49dd587ed8f696823b761db87e59d277f0027dc331269ae59b218f3d820972632481317cda8f2d7ac771e9f660dd9ca5cd899ee072eb71c95606d6af6d456e47d2c423b68dff58f9767367a11ee94c6bcea29812a91c43e10c669319985e47956a526bf4aa7d1134ed555919a8b0f9e5406f799f8a6aeefd84066e5e8988fcdbd3a339d7fa172d8ff1abd1c00c0c578a7e54891c244490ce90e96712c8e3b7b03b795a5aeddd493b3eabd6390c594461b20a96ac950be1e4c32dcb7c2da3ae106f39f44e1aacce29b91f0bef459fe73712e785b35404c478f783bc5b3c5772ab72ed8048164452a1d632a44789514e08de622ea519bcbd82f708371d586f46afbc1fdb5422f0344948384ef0013797539de45007d8c45349dcb8cc9bc16cc270d38a10eebefca0d9703105307522c15a151b4ee4242e969102a31e43db8e731235e7eee2d2b236eeaa3e3c7b808c4a7296e
#TRUST-RSA-SHA256 6eae3a383a168009ce62ce86b8f1cc1e89d0b44c4e100d8209cf1f151f5278fe61bfad9695a47564e3ad82f9aeafcdcd43078040faa9cc102c4e66c2b209ebb23006fe8e7a95e494c3a2d13985b338338864efbb745c6a549bb044e4920f9b55053257e888eda26c8b27df4740d5fbf5e323ddc83fa4c2af8cd4194b1a49f87eca8c59650822e8af8be523f9707ba6ebfc026150a303e4338aaa97bedd2677c9d45d8dab43360c04225e5b34975fb59951cf41132e747f796a5a9ebbca4aa1ddbd9d4bf35a603e1bfebf5a8bafd6da52a7e4f6f945bbda707e3d8de702110c9a7cda4325642fa2745f2698deccacb821a3f6eefa64439cd855d253a9d9ae290d83e56f864a35565ef0c2ace5bb06feffecd1548c633715756e4de7355bdb13ddbb575d0307064653c2949759196925fff7d2ab4bd980cf9cbf20612298f2485539db89bb2a13009be6979e39c79d2eecbdf68b9ce15db8f65fb5aad010daa7e3ef38b30ae8ac462c844ba59bc058657643ca2bddd31215e0142da7c35bb9b8641a75a0b69bbac0e1bc9858824778bb50e4012cae29589f181f37e09f7650b1c08ffaeb827353a5993c95a6bfd3eb35e5a1ad9679d6b2d823cfaa7b6d976bee8f1bd21654688e2c309d0c97c8ffd173e0e7d1d69dfeb9e8db00bedd095573f5cb8ef1d2ea57d6bc5768ec399bcd33c987744eb26ef0c7126d4b6e88742f8a5ab2
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(257439);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/29");

  script_cve_id("CVE-2025-20290");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn06798");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn23023");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo61245");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwo71832");
  script_xref(name:"CISCO-SA", value:"cisco-sa-nxos-infodis-TEcTYSFG");
  script_xref(name:"IAVA", value:"2025-A-0635");

  script_name(english:"Cisco NX-OS Software Sensitive Log Information Disclosure (cisco-sa-nxos-infodis-TEcTYSFG)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability.

  - A vulnerability in the logging feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches, Cisco
    Nexus 9000 Series Switches in standalone NX-OS mode, Cisco UCS 6400 Fabric Interconnects, Cisco UCS 6500
    Series Fabric Interconnects, and Cisco UCS 9108 100G Fabric Interconnects could allow an authenticated,
    local attacker access to sensitive information. This vulnerability is due to improper logging of sensitive
    information. An attacker could exploit this vulnerability by accessing log files on the file system where
    they are stored. A successful exploit could allow the attacker to access sensitive information, such as
    stored credentials. (CVE-2025-20290)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-infodis-TEcTYSFG
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?12be5079");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn06798");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn23023");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo61245");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo71832");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwn06798, CSCwn23023, CSCwo61245, CSCwo71832");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20290");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/27");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Settings/ParanoidReport", "Host/Cisco/NX-OS/Device");

  exit(0);
}

include('ccf.inc');

if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var product_info = cisco::get_product_info(name:'Cisco NX-OS Software');


if (('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])3[0-9]{2,3}") &&
    ('Nexus' >!< product_info.device || product_info.model !~ "(^|[^0-9])9[0-9]{2,3}"))
audit(AUDIT_HOST_NOT, 'affected');

var version_list = [];

if ('Nexus' >< product_info.device && product_info.model =~ "^3[0-9]{2,3}")
{
  version_list = make_list(
    '7.0(3)F3(1)',
    '7.0(3)F3(2)',
    '7.0(3)F3(3)',
    '7.0(3)F3(3a)',
    '7.0(3)F3(4)',
    '7.0(3)F3(3c)',
    '7.0(3)F3(5)',
    '7.0(3)I4(4)',
    '7.0(3)I4(5)',
    '7.0(3)I4(6)',
    '7.0(3)I4(7)',
    '7.0(3)I4(8)',
    '7.0(3)I4(8a)',
    '7.0(3)I4(8b)',
    '7.0(3)I4(8z)',
    '7.0(3)I4(6t)',
    '7.0(3)I4(9)',
    '7.0(3)I5(1)',
    '7.0(3)I5(2)',
    '7.0(3)I5(3)',
    '7.0(3)I5(3a)',
    '7.0(3)I5(3b)',
    '7.0(3)I6(1)',
    '7.0(3)I6(2)',
    '7.0(3)I7(1)',
    '7.0(3)I7(2)',
    '7.0(3)I7(3)',
    '7.0(3)I7(4)',
    '7.0(3)I7(5)',
    '7.0(3)I7(5a)',
    '7.0(3)I7(3z)',
    '7.0(3)I7(6)',
    '7.0(3)I7(6z)',
    '7.0(3)I7(7)',
    '7.0(3)I7(8)',
    '7.0(3)I7(9)',
    '7.0(3)I7(9w)',
    '7.0(3)I7(10)',
    '9.2(1)',
    '9.2(2)',
    '9.2(2t)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '9.2(2v)',
    '7.0(3)IM7(2)',
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '10.1(1)',
    '10.1(2)',
    '10.1(2t)',
    '10.2(1)',
    '10.2(2)',
    '10.2(3)',
    '10.2(3t)',
    '10.2(4)',
    '10.2(5)',
    '10.2(3v)',
    '10.2(6)',
    '10.2(7)',
    '10.2(8)',
    '10.2(9)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(4a)',
    '10.3(4)',
    '10.3(5)',
    '10.3(6)',
    '10.3(7)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)'
  );
}

if ('Nexus' >< product_info.device && product_info.model =~ "^9[0-9]{2,3}")
{
  version_list = make_list(
    '7.0(3)F3(1)',
    '7.0(3)F3(3)',
    '7.0(3)F3(3a)',
    '7.0(3)F3(4)',
    '7.0(3)F3(3c)',
    '7.0(3)F3(5)',
    '7.0(3)I4(4)',
    '7.0(3)I4(5)',
    '7.0(3)I4(6)',
    '7.0(3)I4(7)',
    '7.0(3)I4(8)',
    '7.0(3)I4(8a)',
    '7.0(3)I4(8b)',
    '7.0(3)I4(8z)',
    '7.0(3)I4(6t)',
    '7.0(3)I4(9)',
    '7.0(3)I5(1)',
    '7.0(3)I5(2)',
    '7.0(3)I5(3)',
    '7.0(3)I5(3a)',
    '7.0(3)I5(3b)',
    '7.0(3)I6(1)',
    '7.0(3)I6(2)',
    '7.0(3)I7(1)',
    '7.0(3)I7(2)',
    '7.0(3)I7(3)',
    '7.0(3)I7(4)',
    '7.0(3)I7(5)',
    '7.0(3)I7(5a)',
    '7.0(3)I7(3z)',
    '7.0(3)I7(6)',
    '7.0(3)I7(7)',
    '7.0(3)I7(8)',
    '7.0(3)I7(9)',
    '7.0(3)I7(9w)',
    '7.0(3)I7(10)',
    '9.2(1)',
    '9.2(2)',
    '9.2(3)',
    '9.2(3y)',
    '9.2(4)',
    '7.0(3)IA7(1)',
    '7.0(3)IA7(2)',
    '9.3(1)',
    '9.3(2)',
    '9.3(3)',
    '9.3(1z)',
    '9.3(4)',
    '9.3(5)',
    '9.3(6)',
    '9.3(5w)',
    '9.3(7)',
    '9.3(7k)',
    '9.3(7a)',
    '9.3(8)',
    '9.3(9)',
    '9.3(10)',
    '9.3(11)',
    '9.3(12)',
    '9.3(13)',
    '9.3(14)',
    '9.3(15)',
    '10.1(1)',
    '10.1(2)',
    '10.2(1)',
    '10.2(1q)',
    '10.2(2)',
    '10.2(3)',
    '10.2(2a)',
    '10.2(4)',
    '10.2(5)',
    '10.2(6)',
    '10.2(7)',
    '10.2(8)',
    '10.2(9)',
    '10.3(1)',
    '10.3(2)',
    '10.3(3)',
    '10.3(99w)',
    '10.3(3w)',
    '10.3(99x)',
    '10.3(3o)',
    '10.3(4a)',
    '10.3(3p)',
    '10.3(4)',
    '10.3(3q)',
    '10.3(3x)',
    '10.3(5)',
    '10.3(4g)',
    '10.3(3r)',
    '10.3(6)',
    '10.3(4h)',
    '10.3(7)',
    '10.4(1)',
    '10.4(2)',
    '10.4(3)',
    '10.4(4)',
    '10.4(5)',
    '10.4(4g)',
    '10.5(1)',
    '10.5(2)',
    '10.5(3)',
    '10.5(3t)',
    '10.5(3e)',
    '10.5(3o)'
  );
}

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwn06798, CSCwn23023, CSCwo61245, CSCwo71832',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_versions:version_list
);