Cisco Emergency Responder Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)

#TRUSTED 751941aa299319b6889a95887da59f27fbd57824c88579dae6126534f495d8a98052e5e6636656c36a49c726e6e8ba128797384cc82ba27e646e39774ce55738ad6973684ccb4c97f4cf5b30034d40986a79fd1b8d9c665c2ba596def490738f3fc7822252a0d543ed8ea9116d3b216ace28fc8483fd20b6f6a023405afaab91f76d7231fe456a33e1b4556a59ded66473f5464687422ccbc684927e51a3b1cbf739c985c95715bc61688512f6af68b500a36fd41a606ff62653398255396c5e4fe5b966801b7d4d3a5eef3e2f9f88805a2b0966cf4d14e491606498391a2289acc78eeccf76c411cf3fe1cfb199f1128c806b1e744b63319b757669296f4e5e2aa7b8cebb75a32be103af067d518f3a0953c4c4b1b95a10f1d39b3b9bdab19b4956389dfbed0182df2dc8e60a02c22dfb6841eb97d17fc4e8ddc439d7bbdf15a02d30b5c72bbd42a196fdbee02c0bbf9263701ddfffa572f52c4024d325645e466c545274043df654c6ffff2f0997e2da5a667116ea1cd6a6a2febd3e3ea612bc151be6445d438cd2beafef847bce50e93f04aa18356d26ec9f801493bca6b4b7189e32202e0e07cbbec1456c743700e9c3366584c42a0c51cea3d4728e2bddec1a4adf284ff699ccde06080ac59ab1173728503c63cb59ef25c3fa59e1a3a4e9c4cf14084354d33b9ffd0179b454cc5aa89127c5aaea4894b374299c1a3a99
#TRUST-RSA-SHA256 a8f75560ba722610430aea37e36480b3ff927e8493e764719c3dbf46bdd025b5c1e3f768d62b628664a9d8057e510eaf85a6a1b14b6ab255e98bba3808edbacedb615462f8d329adaa5a1bde6686e66e9e53c1d5c838bd0fa931734af0ecd07e776de015699f57654c8c5a1a634608ff52b457ff982c2eb828295215eadb80e66de257fe3f38002fb013aa41c5f4e634ec08c9d73b4b8adb73a3d1212a9880efd06425bb1eddd9c26f38a4316b062d842044a0722a080028f877f7a26d2e6127381904b45bab075ea82f5f7a4ae4c89bacf8601c99926cc26a19debe9440b15c2250c4a688c6542dfc0b0de8844941ceb5beefaedd7f02cc4366cf6a68aba297184c55148853f46c7df9c7bca2da48bbf0493a25796011c12a10088ac7c4ebb631f3cf70f42416e81d0a990768656963882bdde136482ad74aead817628d770bf9a9f6662cf72c648f0e1ddd0b82653b0cc2b42b53acb729224be463ea002d34b8048b63068161fa4049ec95f80497c8f91f75d5f0b733236a053ffc7b6bf54510b43f20614ba1fa0be1bc905006ee33dc9b1501cb015ba7c6ad3f0590c81b9b8027b4677227cb1fac884a23302a6d195a3beeb0e3c9ddd70780dd37d0fd0b0ea1867ea43c118407fa3f02461cda36e7e7bfaa6f59fa8bb7ca3fb1a72eebfcc1dc43faaa036db4d6d6c43cb3398174620937704dbdd9d075c74c06d4d6250fa4
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(312167);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/06");

  script_cve_id("CVE-2024-6387");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwk63694");
  script_xref(name:"CISCO-SA", value:"cisco-sa-openssh-rce-2024");

  script_name(english:"Cisco Emergency Responder Remote Code Execution Vulnerability (regreSSHion) (cisco cisco-sa-openssh-rce-2024)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Emergency Responder is affected by a vulnerability.

  - A remote code execution vulnerability exists in Cisco Emergency Responder due to a signal handler race condition
    found in sshd, where a client does not authenticate within LoginGraceTime seconds, after which the sshd SIGALRM handler
    is called asynchronously. An unauthenticated, remote attacker can exploit this to call various functions that are not
    async-signal-safe with root privileges. (CVE-2024-6387)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssh-rce-2024
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1ac35fe1");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk63694");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwk63694");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6387");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/05");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:emergency_responder");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_voss_emergency_responder_installed.nbin");
  script_require_keys("installed_sw/Cisco Emergency Responder (CER)", "Settings/ParanoidReport");

  exit(0);
}

include('vcf_extras.inc');

if (report_paranoia < 2) 
  audit(AUDIT_PARANOID);

var app_info = vcf::get_app_info(app:'Cisco Emergency Responder (CER)');

var constraints = [
  # 15SU2 - https://software.cisco.com/download/home/286331940/type/286319236/release/15SU2
  {'min_version': '15.0.1.10000.34', 'fixed_version': '15.0.1.12900.234'},
  # 14SU4 - https://software.cisco.com/download/home/286328117/type/286319236/release/14SU4
  {'min_version': '14.0.1.14900.27', 'fixed_version': '14.0.1.14900.94'}
];

vcf::cisco_cer::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);